Last 7 Days (August 05 – August 11, 2026)
In overparameterised classification, training data can be linearly separable even when the underlying distribution is not. In this setting, gradient descent (GD) on the logistic loss diverges in norm while converging in direction to a max-margin interpolating classifier, whose implicit bias can be statistically suboptimal. In this work, we show that early stopping can overcome this suboptimality: in a Gaussian mixture model with label-flipping noise, GD stopped at an appropriate oracle time achieves minimax-optimal excess zero-one risk for covariance spectra with fast and continuous decay, including polynomial and exponential spectral decays. Our analysis combines a sharp upper bound for the early-stopped iterate with a matching statistical lower bound over arbitrary classifiers, yielding optimal rates that are validated by experiments. A central technical contribution is a new calibration result that converts excess logistic risk into excess zero-one risk; it handles the model misspecification induced by the label-flipping noise, and removes the square-root rate in standard bounds. We also establish a lower bound for linear interpolators, showing that interpolation can require exponentially more samples than early stopping to achieve the same excess risk.
Primary: University of Oxford
All Institutions: University of Oxford
The paper presents a rigorous theoretical analysis demonstrating that early-stopped gradient descent achieves minimax-optimal excess zero-one risk in Gaussian mixture models, outperforming max-margin interpolators by a significant margin in sample complexity.
The paper addresses a fundamental tension in overparameterized classification: the statistical suboptimality of max-margin interpolators (implicit bias of GD) versus the potential benefits of early stopping. The methodology is theoretically rigorous, focusing on a Gaussian Mixture Model (GMM) with label-flipping noise. The core technical contributions are twofold: (1) deriving sharp upper bounds on the excess zero-one risk of early-stopped Gradient Descent (GD) for covariance spectra with fast decay (polynomial/exponential), and (2) establishing a novel calibration result that converts excess logistic risk to excess zero-one risk, effectively removing the square-root rate penalty typical in standard bounds under model misspecification. The authors also prove a lower bound for linear interpolators, demonstrating an exponential sample complexity gap compared to early-stopped GD. This is a significant theoretical advance in understanding the implicit regularization of GD in classification settings.
The abstract mentions that the optimal rates are validated by experiments. Given the theoretical nature of the work, the experiments likely serve to corroborate the derived rates in synthetic GMM settings. While the theoretical results are strong, the lack of extensive empirical validation on real-world datasets or more complex models (e.g., deep networks) limits the immediate practical impact, though this is common for high-theory papers. The validation of the "oracle time" stopping criterion is crucial; if the experiments show that this time is practically estimable or robust, the impact increases. However, the abstract implies an "oracle time," which may limit direct applicability without further algorithmic development.
The paper provides a full theoretical derivation with appendices for proofs. The notation is standard. Reproducibility of the theoretical claims is high for other theorists. Reproducibility of the empirical claims depends on the code availability, which is not explicitly linked in the provided text (URLs are "none"), but the mathematical framework is self-contained.
The primary limitation is the reliance on the "oracle time" for early stopping. In practice, knowing the optimal stopping time requires knowledge of the underlying distribution or validation data, which may not be available. The paper establishes a lower bound for interpolators, but does not provide a practical algorithm to find the optimal early stopping point without oracle knowledge. Additionally, the analysis is restricted to linear classifiers on Gaussian mixtures, which, while a canonical model, does not directly translate to non-linear deep learning settings without further bridging theory.
This work provides a rigorous theoretical justification for the use of early stopping in classification, a heuristic widely used in practice but poorly understood theoretically in the context of interpolation. It clarifies why max-margin solutions can be suboptimal and how early stopping mitigates this. This contributes to the broader field of algorithmic stability and implicit regularization, potentially guiding the design of better training procedures for overparameterized models. The paper presents a rigorous theoretical analysis demonstrating that early-stopped gradient descent achieves minimax-optimal excess zero-one risk in Gaussian mixture models, outperforming max-margin interpolators by a significant margin in sample complexity.
Recent systems for optimizing prompts, programs, and ML workflows typically rely on explicit outer-loop controllers such as evolutionary search, bandits, or textual-gradient methods. We ask a fundamentally different question: how much of this search policy can be internalized by a single tool-using agent? We present ReASearch, a unified framework for reasoning-driven optimization in which the agent autonomously decides what to evaluate, how to diagnose failures, which edits to make, and when to verify or restart. Rather than serving only as a proposal generator guided by hand-designed heuristics, the agent actively analyzes outcomes, allocates budget, and refines its strategy over long horizons through persistent memory. With a shared agent loop and domain-specific tools, ReASearch instantiates the exact same scaffold to optimize prompts, programs, and ML workflows. Across 14 diverse tasks, it is competitive with and mostly better than specialized optimization systems, achieving gains of 2% to 40% over strong domain-specific baselines, and in some cases discovering solutions that improve on prior human best-known results. Crucially, we observe that complex search behaviors, which are typically implemented by explicit controllers, emerge naturally from the agent's reasoning process.
Primary: The University of Texas at Austin
All Institutions: The University of Texas at Austin, Snowflake
The paper presents ReASearch, a unified, reasoning-driven agentic framework that internalizes complex search policies previously handled by explicit controllers, demonstrating competitive or superior performance across 14 diverse optimization tasks in prompts, programs, and ML workflows.
The paper proposes ReASearch, a unified framework that replaces explicit, hand-designed outer-loop controllers (such as evolutionary algorithms, bandits, or Bayesian optimization) with a single, persistent, tool-using LLM agent. The core methodological contribution is the formulation of optimization as a sequential reasoning problem where the agent autonomously decides evaluation strategies, diagnoses failures, and manages memory across long horizons. The architecture is domain-agnostic, relying on a shared scaffold with domain-specific tool sets for prompt optimization, program evolution, and ML workflow tuning. The approach leverages persistent memory (lessons.md) and context compression to maintain state, allowing the agent to "learn" from past failures and successes without external algorithmic guidance. This represents a significant shift from "LLM as optimizer" to "LLM as the search policy itself."
The evaluation is comprehensive, spanning 14 diverse tasks across three categories: prompt optimization (AIME, HotpotQA, GSM8K, Terminal-Bench), program evolution (Circle Packing, Heilbronn Triangles, EPLB, TXN, ARC-AGI-2), and ML workflow optimization (NanoGPT, IMG-100, Atari, MuJoCo, Kaggle Crypto). ReASearch is compared against strong, specialized baselines including GEPA, AdaEvolve, and Claude Code (AutoResearch). The results are compelling: ReASearch matches or exceeds specialized systems, achieving gains of 2-40%. Notably, it discovers solutions improving upon human best-known results in geometric optimization (Heilbronn, Circle Packing) and significantly outperforms generalist code agents in ML workflow tuning. The analysis of agent trajectories provides qualitative evidence of emergent optimizer behaviors (e.g., double-verification, revert-based recovery, hypothesis-driven revision), supporting the claim that reasoning can internalize search logic.
The paper provides detailed descriptions of the tool sets, memory mechanisms, and experimental settings. It includes ablation studies on memory and Python execution capabilities. However, the reliance on proprietary models (Claude Sonnet 4.6, GPT-5, GPT-4.1 mini) for both the agent and student models limits full reproducibility of the specific performance numbers, although the framework itself is described in sufficient detail to be implemented. The use of standard benchmarks (AIME, ARC-AGI-2, etc.) aids in future comparative evaluation.
The approach is computationally expensive due to the high cost of LLM reasoning and tool calls, although the authors argue it is competitive in API costs with specialized methods. The performance is heavily dependent on the capability of the underlying frontier LLM; the paper notes that open-source models (GLM-5, Kimi-2.5) perform well but still trail behind the proprietary baselines, suggesting a ceiling on current open-source reasoning capabilities for this task. The "black box" nature of the agent's reasoning, while analyzed qualitatively, lacks the rigorous theoretical guarantees of traditional optimization methods.
This work has significant implications for the field of Agentic ML, suggesting that complex search policies need not be hard-coded but can emerge from general reasoning capabilities. It democratizes access to sophisticated optimization by providing a unified scaffold that works across domains, potentially reducing the engineering burden of building domain-specific optimizers. It also highlights the potential of LLMs to act as scientific discoverers, as evidenced by the geometric optimization results. The paper presents ReASearch, a unified, reasoning-driven agentic framework that internalizes complex search policies previously handled by explicit controllers, demonstrating competitive or superior performance across 14 diverse optimization tasks in prompts, programs, and ML workflows.
Language models differ in how safely they behave and these differences are measured by safety benchmarks. But aggregated benchmark scores are hard to trust and interpret, because benchmarks duplicate one another, correlate heavily, and models may sandbag when they detect evaluation. To address these issues, we draw on Item Response Theory (IRT), a statistical toolkit for measuring these latents from performance on items with inferred psychometric properties. We fit IRT models to eight safety benchmarks across 192 language models, the largest psychometric analysis of LLM safety evaluations to date, and contribute three results. First, we find that three interpretable factors of refusal strictness, truthfulness, and contextual harm explain most of the variance between models across benchmarks. Second, psychometrically selected items recover full benchmark scores with lower error than random subsets of the same size, and roughly ten adaptively chosen items suffice for several individual benchmarks, cutting evaluation cost by 97-99%. Third, IRT supports audits of individual models, showing that it can be used to detect naive sandbagging and changes of model behind APIs. Overall, we show IRT is a ready-made toolkit for reading, reducing, and auditing safety benchmarks, which we recommend frontier labs and evaluators adopt.
Primary: UK AI Security Institute
All Institutions: UK AI Security Institute, Department for Science, Innovation, and Technology, Supervised Program for Alignment Research
This paper presents a rigorous psychometric analysis of LLM safety benchmarks, demonstrating that IRT can effectively decompose safety into latent factors, distill evaluation costs, and detect behavioral anomalies, offering a valuable methodological advancement for the field.
The paper applies Item Response Theory (IRT), a well-established psychometric framework, to the domain of Large Language Model (LLM) safety evaluation. The methodology involves fitting Two-Parameter Logistic (2PL) IRT models to item-level responses from 192 models across eight safety benchmarks. The authors employ standard psychometric techniques, including factor analysis to identify latent safety traits (refusal strictness, truthfulness, contextual harm), Fisher information for item selection, and person-fit statistics for anomaly detection. The approach is methodologically sound and rigorously applied, utilizing regularization to handle the specific data sparsity characteristics of LLM evaluations (many items, fewer models). While the application of IRT to LLMs is not entirely new (citing prior work on capability benchmarks), its systematic application to the complex, multi-dimensional landscape of *safety* benchmarks, particularly for the purpose of distillation and auditing, represents a sophisticated and novel synthesis of psychometrics and AI safety.
The experimental setup is robust, leveraging a large-scale dataset of 5,255 items and 192 models. The results are compelling: the authors demonstrate that three latent factors explain the majority of variance, that psychometrically selected items can recover benchmark scores with significantly lower error than random subsets (cutting evaluation cost by 97-99%), and that IRT-based person-fit statistics can detect specific forms of sandbagging and API substitution. The use of held-out splits and comparison against random baselines strengthens the claims regarding benchmark distillation. The detection of "naive sandbagging" is a strong empirical finding, though the authors correctly note limitations regarding sophisticated, adversarial sandbagging.
The paper provides extensive details on the preprocessing, model fitting (including regularization priors), and evaluation metrics. The inclusion of a full model roster and benchmark coverage matrix in the appendix enhances transparency. The reliance on OpenRouter's API for data collection is a potential reproducibility hurdle for exact replication of the *collection* phase, but the analysis code and data package are mentioned as available in supplementary material, which is standard practice. The clear description of the 2PL model and factor analysis procedures allows for independent verification of the statistical claims.
The authors acknowledge several limitations. The cohort size (192 models) is large for LLM studies but smaller than traditional human psychometric datasets, which may affect the stability of parameter estimates. The sandbagging detection is evaluated on "prompted model organisms" rather than fine-tuned models, which may behave differently. The factor analysis relies on empirical loading patterns, and the interpretation of latent factors as distinct "abilities" requires further validation. Additionally, the method assumes that the benchmarks are measuring stable traits, which may be violated if models exhibit context-dependent safety behaviors not captured by the static items.
This work has significant implications for the AI safety community. By providing a rigorous statistical framework for interpreting safety benchmarks, it addresses critical concerns about the validity and reliability of current evaluation practices. The ability to distill benchmarks could make safety evaluation more efficient and accessible, while the auditing capabilities offer a new tool for detecting deceptive behavior or model substitution in API-based systems. The recommendation for frontier labs to adopt these psychometric standards could lead to more trustworthy and comparable safety assessments across the industry. This paper presents a rigorous psychometric analysis of LLM safety benchmarks, demonstrating that IRT can effectively decompose safety into latent factors, distill evaluation costs, and detect behavioral anomalies, offering a valuable methodological advancement for the field.
Differentiable simulation is a key component in learning, control, and inverse problems, where gradients through nonlinear implicit solvers are required. Existing approaches either rely on unrolled automatic differentiation, whose memory grows with solver depth, or on equation-level implicit differentiation, which assembles global Jacobians and solves large sparse adjoint systems, discarding the locality of the forward solver -- and differentiating the converged equation rather than the finite computation that actually ran. We propose solver-level differentiation, which differentiates the executed solver itself. When a solver is composed of block implicit updates, its discrete adjoint is obtained by applying the corresponding adjoint updates in reverse order, yielding a reverse-sweep formulation whose backward pass mirrors the forward solver. From an operator perspective, the forward pass realizes an approximate inverse through ordered local solves, and the backward applies its transpose through reverse local adjoint solves, constructing no global system. We instantiate this idea on Vertex Block Descent, yielding a differentiable solver whose reverse colored Gauss-Seidel sweeps are composed entirely of local $3\times 3$ adjoint solves. The backward matches automatic differentiation through the identical executed forward to machine precision at every solver depth, where the equation-level adjoint is off by 37% after one sweep; in a controlled same-codebase, same-GPU comparison it is 33x faster and uses 71x less memory than unrolled automatic differentiation; and the same construction is exact on projective dynamics and extended position-based dynamics. We scale differentiable elastodynamics to $10^6$ contact-coupled soft bodies (8M vertices) on one GPU. Overall, this work highlights solver structure as a practical organizing principle for efficient differentiable simulation.
Primary: The University of Utah
All Institutions: The University of Utah, University of California
This paper introduces a highly efficient and exact solver-level differentiation method for block-coordinate implicit solvers, enabling scalable differentiable elastodynamics at the million-vertex scale with significant memory and speed advantages over existing approaches.
The paper proposes a novel "solver-level differentiation" framework for block-coordinate implicit solvers, specifically instantiated on Vertex Block Descent (VBD). The core technical insight is that the discrete adjoint of a block-coordinate sweep is a reverse-order sweep of local adjoint solves, preserving the locality and parallel structure of the forward pass. This contrasts sharply with standard equation-level implicit differentiation (which requires solving a global adjoint system) and unrolled automatic differentiation (which requires storing a large tape). The authors derive exact conditions for finite-depth exactness, identifying three often-overlooked terms (update saturation Jacobian, Hessian-tangent term, validity gates) that must be included to match unrolled AD at finite solver depths. The methodology is mathematically rigorous, providing a theorem for the exact discrete adjoint and detailed derivations for the local vector-Jacobian products.
The experimental evaluation is comprehensive and convincing. The authors provide controlled comparisons against unrolled AD, assembled global adjoints, and matrix-free global adjoints on a single GPU. Key results include: 1) Machine-precision gradient matching with unrolled AD at all solver depths, whereas equation-level adjoints are significantly inaccurate at low solver depths (37% error at K=1). 2) Significant efficiency gains: 33x faster and 71x less memory than unrolled AD. 3) Scalability to 10^6 contact-coupled soft bodies (8M vertices) on a single GPU, a scale previously difficult for differentiable elastodynamics. The inverse problem tasks (material identification, rest-shape recovery, wind control) demonstrate the practical utility of the gradients. The ablation study on the three exactness terms is particularly strong, showing how omissions lead to subtle but critical errors.
The paper includes a detailed reproducibility statement, noting that all claims are produced by a released harness. It specifies hardware (RTX 4090, A6000, H100), software versions (CUDA 12.1, PyTorch 2.3), and implementation details (Warp kernels, fused CUDA C++). The code is described as constructing scenes procedurally, removing data dependencies. The authors provide closed forms for local adjoints and detailed algorithm descriptions. This level of detail strongly supports reproducibility.
The primary limitation is that the evaluation is focused on a specific solver family (Vertex Block Descent) and its variants (XPBD, Projective Dynamics). While the theorem is general for block-coordinate solvers, the practical impact is currently tied to this class of methods. The authors acknowledge that equation-level differentiation is better suited for applications requiring the derivative of a fully converged solve, whereas this method targets the finite-depth solver. Additionally, Coulomb friction with active-set changes is noted as future work. The scalability to 10^6 bodies relies on specific contact penalties and broad-phase structures that may not generalize to all contact scenarios without modification.
This work significantly advances the field of differentiable simulation by enabling efficient, scalable, and exact gradient computation for stiff physical systems. It bridges the gap between numerical linear algebra (block solvers) and machine learning (differentiable layers), allowing for large-scale inverse problems and control in soft robotics, computer graphics, and scientific computing. By reducing memory and computational costs, it makes differentiable simulation accessible for larger and more complex systems, potentially accelerating research in physics-informed machine learning and simulation-based optimization. This paper introduces a highly efficient and exact solver-level differentiation method for block-coordinate implicit solvers, enabling scalable differentiable elastodynamics at the million-vertex scale with significant memory and speed advantages over existing approaches.
Recommendation systems thrive on personalization, where ''correctness'' is rarely a binary truth but a matter of subjective human preference. As Large Language Models (LLMs) are deployed as autonomous verifiers of safety and quality guidelines, they face a distinctive challenge: context-aware preference alignment. Recent gains in Reinforcement Learning with Verifiable Rewards (RLVR) are indexed mostly on objective, mathematical tasks. Through a large-scale study spanning both proprietary and open-source models on four real-world verification tasks from a production recommender platform, we ask whether explicit reasoning generalizes to subjective, human-centric industry rubrics. We expose a fundamental vulnerability: rigid, math-centric reasoning traces actively degrade verification, and applying standard RLVR triggers a phenomenon we term reasoning collapse, in which the policy abandons deliberation in favor of rapid heuristic guessing. We introduce a conditional length-penalized post-training algorithm that intertwines verification accuracy with bounded reasoning length, halting collapse and recovering performance. Finally, we show that a reasoning trace's efficacy is tightly coupled with its socio-linguistic framing: across 1500 synthesized personas, verification accuracy swings by nearly 0.38 macro-F1 depending solely on the adopted reasoning persona---evidence that much subjective-verification error is really reasoning-style mismatch. This observation motivates a mid-training architecture that routes reasoning through contextually aligned personas. This work offers both a scalable algorithmic patch and a long-term architectural blueprint for aligning reasoning models with real-world subjective constraints.
Primary: Netflix
All Institutions: Duke University, Netflix
The paper provides a critical empirical analysis of the limitations of Chain-of-Thought and RLVR in subjective domains, introducing a practical mitigation strategy (conditional length penalization) and highlighting the need for persona-aligned reasoning in LLM verifiers.
The paper proposes a conditional length-penalized reward for Reinforcement Learning with Verifiable Rewards (RLVR) to mitigate "reasoning collapse" in subjective verification tasks. The core methodological contribution is the observation that standard RLVR on subjective tasks leads to heuristic guessing (shorter reasoning) and the introduction of a reward function that gates length bonuses on answer correctness. Additionally, it explores persona-driven reasoning as a mid-training blueprint. The methodology is sound but largely empirical/algorithmic tuning rather than a novel theoretical framework. The "persona routing" is presented as a preliminary blueprint rather than a fully implemented and evaluated system, limiting its immediate methodological impact.
The experiments are conducted on real-world Netflix data, which is a significant strength regarding ecological validity. The study covers four subjective verification tasks and compares proprietary and open-source models. The findings are robust: explicit reasoning degrades performance on proprietary models, and standard RLVR causes collapse. The conditional reward successfully recovers performance. However, the "persona" experiments are synthetic and preliminary, lacking a full training loop for the routing mechanism. The evaluation is rigorous for the post-training component but light on the architectural proposal.
The paper provides detailed hyperparameters for the RLVR experiments (learning rates, KL coefficients, batch sizes). However, the primary dataset (Netflix production data) is proprietary and not publicly available, which severely limits reproducibility for the specific tasks evaluated. The open-source model experiments (Mistral, Qwen) are reproducible in principle but depend on the specific internal rubrics which are only described abstractly.
The authors explicitly acknowledge that the persona routing is a blueprint, not a solved problem. The reliance on proprietary data limits generalizability and independent verification. The study focuses on binary verification tasks, which may not capture the full complexity of subjective reasoning. The "persona" analysis is based on static synthesis rather than dynamic learning.
This work has significant implications for the deployment of LLMs in content moderation, safety, and recommendation systems where subjective judgment is required. It challenges the prevailing assumption that more reasoning (CoT/RLVR) is always better, providing a cautionary tale for practitioners. The insights into "reasoning collapse" are valuable for the broader field of RLHF/RLVR. The paper provides a critical empirical analysis of the limitations of Chain-of-Thought and RLVR in subjective domains, introducing a practical mitigation strategy (conditional length penalization) and highlighting the need for persona-aligned reasoning in LLM verifiers.
Model merging has become the default way to give an aligned language model new skills without retraining: a practitioner folds task vectors from math, code, or domain specialists into a safety-aligned base using task arithmetic, TIES, or DARE. This convenience is known to carry a safety cost, but almost all of that evidence rests on static refusal tests: fixed harmful prompts scored for compliance. We argue this is misleading. Because safety alignment is "shallow," concentrated in the first few generated tokens, a merged model's static refusal can stay clean while a real adaptive attack still breaks it. We introduce SkillSafe-Bench, a controlled benchmark that scores skill-merged models on static refusal, adaptive jailbreak robustness, and capability retention under a conservative two-judge AND rule. Across six open-weight bases (five families, two scales), static safety does not predict robustness to attack: under a semantic template attack, safe-looking merges on the fragile bases (both Qwen scales and Gemma) are jailbroken 60-76% of the time while others (Llama, Phi-4) stay robust. We further show the static effect of merging is base-conditional, characterize same-recipe abliteration-style safety erosion through a data-free geometric signal (the overlap of a task vector with a safety subspace), and outline SubSafe-Merge, which projects this overlap away to remove that erosion at held capability. Adaptive evaluation is not optional for merged LLMs: the models that most need it look safe under static screening.
Primary: University of New South Wales
All Institutions: University of New South Wales, Australian National University, University of Technology Sydney, Zhejiang University
The paper introduces SkillSafe-Bench and SubSafe-Merge, demonstrating that static safety metrics are insufficient for evaluating skill-merged LLMs and providing a geometric method to mitigate specific safety erosion. This is a strong, timely contribution to AI safety, particularly given the popularity of model merging. The empirical findings are robust and the proposed mitigation is elegant, though its applicability is currently limited to specific types of safety erosion. The work is well-executed and addresses a critical gap in the field.
The paper proposes a rigorous evaluation framework (SkillSafe-Bench) and a mitigation technique (SubSafe-Merge) for safety-eroding effects in model merging. The core methodological contribution is the identification of a "static-adaptive gap" in merged models and the use of weight-space geometry (safety subspace overlap) to detect and remove safety-eroding task vectors. The approach is theoretically grounded in the concept of shallow alignment and leverages standard linear algebra operations (SVD, projection) to implement the mitigation. While the geometric signal is novel in this specific context, the underlying mechanics are standard linear algebra applied to weight differences.
The experimental evaluation is comprehensive and well-controlled. The authors test across six base models, multiple skills, and various merging methods. They employ multiple adaptive attack vectors (GCG, PAIR, template attacks) and a conservative two-judge evaluation protocol. The results clearly demonstrate that static safety metrics fail to predict adaptive robustness, particularly for Qwen and Gemma bases. The ablation studies and boundary condition tests (e.g., out-of-S erosion) add significant rigor. The use of paired statistical tests (McNemar) strengthens the claims about the static-adaptive gap.
The paper provides detailed hyperparameters, attack configurations, and mentions a code/data supplement. The methodology is deterministic enough (fixed seeds, specific libraries) to allow for reproduction. The reliance on public models and benchmarks further aids reproducibility.
The primary limitation is the narrow scope of the geometric signal: it effectively detects only "same-recipe" abliteration-style refusal removal. It fails to detect safety erosion from other sources (e.g., SFT/DPO decensored models) that lie outside the estimated safety subspace. Additionally, the study is limited to 7-8B parameter models, and the generalizability to larger models or different architectures is not fully established. The "safety subspace" itself is an estimate derived from a public abliterated model, which may not perfectly capture the true safety direction for all bases.
This work has significant implications for the safe deployment of merged LLMs. By highlighting the inadequacy of static safety checks and providing a data-free method to mitigate specific types of safety erosion, it offers a practical tool for practitioners. It also raises important questions about the robustness of safety alignment in the face of model composition. The benchmark itself could become a standard for evaluating merged models. The paper introduces SkillSafe-Bench and SubSafe-Merge, demonstrating that static safety metrics are insufficient for evaluating skill-merged LLMs and providing a geometric method to mitigate specific safety erosion. This is a strong, timely contribution to AI safety, particularly given the popularity of model merging. The empirical findings are robust and the proposed mitigation is elegant, though its applicability is currently limited to specific types of safety erosion. The work is well-executed and addresses a critical gap in the field.
Recent advancements in Speech Large Language Models have demonstrated remarkable capabilities in understanding complex audio tasks. Despite this progress, their long-context inference remains severely bottlenecked by prohibitive KV cache memory demands. Existing text-centric compression methods struggle here, often disrupting speech continuity or discarding crucial semantic cues. To address this, we propose VoxZip, a train-free, two-stage semantic-anchored KV cache compression framework. The first stage uses automatic speech recognition (ASR) transcriptions as explicit semantic anchors to temporally align, compress, and fuse audio tokens, significantly reducing the initial KV cache while elevating token information density. To further improve the compression ratio, the second stage employs a dynamic filtering strategy based on temporally decayed accumulated attention to evict non-essential tokens while mitigating early-token bias. Comprehensive evaluations on Qwen3-Omni across six diverse audio benchmarks demonstrate the superiority of our approach. VoxZip excels in long-audio reasoning and consistently maintains high-fidelity perception on short-form tasks. Notably, it sustains over 90\% of the uncompressed baseline performance even under an aggressive 20x KV cache compression in long-context scenarios. Furthermore, at a 4x compression ratio, VoxZip yields a 1.9x increase in inference throughput alongside a 3.3x reduction in peak memory overhead. Code and models will be available at https://github.com/MM-Speech/VoxZip.
Primary: Zhejiang University
All Institutions: Zhejiang University, Meituan
[One sentence main contribution]. VoxZip introduces a train-free, two-stage semantic-anchored KV cache compression framework that leverages ASR transcriptions and temporally decayed attention to efficiently compress long-context audio inputs for Speech LLMs. [Comprehensive analysis of the technical contribution, methodology, and significance to the field]. The paper presents a practical and effective solution to the memory bottleneck in long-context Speech LLM inference. By integrating explicit semantic guidance from ASR with dynamic, time-aware token eviction, VoxZip achieves a compelling trade-off between compression ratio and performance retention. While not fundamentally altering the theoretical landscape of attention mechanisms, it provides a highly valuable engineering contribution to the multimodal AI community. The rigorous evaluation across diverse benchmarks and the clear demonstration of efficiency gains make it a significant step forward for efficient audio-language models.
The paper proposes VoxZip, a two-stage KV cache compression framework for Speech Large Language Models (SLLMs). Stage 1 uses ASR transcriptions as semantic anchors to temporally align and compress audio tokens via element-wise addition with text embeddings. Stage 2 employs a temporally decayed accumulated attention score for dynamic token eviction during decoding. The approach is logically sound and addresses a specific gap in SLLM efficiency. However, the novelty is moderate; the use of ASR for alignment is a known heuristic in multimodal processing, and the temporal decay mechanism is a variation of existing attention-sink/eviction strategies (like SnapKV/StreamingLLM) adapted for audio's temporal nature. The "train-free" aspect is a practical benefit but not a fundamental algorithmic breakthrough.
The evaluation is comprehensive, covering six benchmarks (Vox-Infinity, AudioMarathon, SPIRAL, MMSU, MMAU, MMAR) on the Qwen3-Omni model. The results demonstrate significant memory savings (3.3x reduction) and throughput improvements (1.9x) while maintaining >90% of baseline performance at 20x compression. The ablation studies are thorough, validating the necessity of semantic anchors, acoustic preservation, and the temporal decay mechanism. The inclusion of an "Audio-only" upper bound and "Text-only" lower bound provides good context. However, the reliance on an auxiliary ASR model (Whisper-Turbo) introduces latency and error propagation risks that are acknowledged but whose real-world impact on end-to-end latency vs. pure compression gains could be more critically analyzed.
The paper provides detailed implementation details, including hyperparameters (decay factor 0.95, window sizes) and the specific backbone model (Qwen3-Omni-30B). The code is promised on GitHub. The methodology is clearly described with equations. Reproducibility appears high, assuming access to the Qwen3-Omni weights and the Whisper model.
The primary limitation is the dependency on the quality of the ASR transcription. Poor ASR performance (due to noise, accents, or low-resource languages) could degrade the semantic anchors, potentially harming performance. The paper acknowledges this but claims robustness via confidence filtering. Additionally, the element-wise fusion is simplistic; more complex cross-modal fusion might yield better semantic preservation, though at higher computational cost during the prefill stage.
This work contributes to the democratization of long-context audio AI by making it more resource-efficient. It enables deployment of SLLMs on hardware with limited memory, which is crucial for edge devices or large-scale serving. It also highlights the importance of modality-specific compression strategies rather than blindly applying text-centric methods to audio. [One sentence main contribution]. VoxZip introduces a train-free, two-stage semantic-anchored KV cache compression framework that leverages ASR transcriptions and temporally decayed attention to efficiently compress long-context audio inputs for Speech LLMs. [Comprehensive analysis of the technical contribution, methodology, and significance to the field]. The paper presents a practical and effective solution to the memory bottleneck in long-context Speech LLM inference. By integrating explicit semantic guidance from ASR with dynamic, time-aware token eviction, VoxZip achieves a compelling trade-off between compression ratio and performance retention. While not fundamentally altering the theoretical landscape of attention mechanisms, it provides a highly valuable engineering contribution to the multimodal AI community. The rigorous evaluation across diverse benchmarks and the clear demonstration of efficiency gains make it a significant step forward for efficient audio-language models.
In-context learning (ICL) can induce emergent misalignment (EM), where narrow misaligned examples alter answers to unrelated questions. Existing prompts, however, conflate harmful-text exposure with an invitation to continue assistant behavior. We hold harmful answers fixed while varying their delivery as demonstrations, evidence, assistant history, or tool output. Across ten independently sampled contexts, demonstration framing raises broad EM by $30$--$32$ percentage points on a susceptible Gemini model; the gap survives domain exclusion, semantic clustering, unseen questions, and four prompt templates. Format and length-matched controls show that harmful content is necessary but insufficient. A role times continuation factorial further reveals model-dependent provenance effects: Gemini follows both assistant and tool histories, whereas Grok largely resists tool-framed continuation. Several other frontier and open-weight models show no gap. Blinded human audits confirm every main contrast and show that the model judge underestimates active-condition failures. Thus continuation framing is a strong, model-dependent moderator of ICL-EM, not a universal consequence of harmful context.
Primary: Peking University
All Institutions: Peking University, City University of Hong Kong, National Engineering Research Center for Software Engineering
The paper makes a significant contribution to the field of AI safety by rigorously isolating the role of continuation framing in in-context emergent misalignment, providing robust empirical evidence and practical insights for safer LLM deployment.
The paper proposes a rigorous causal dissection of In-Context Learning (ICL) emergent misalignment. The core methodological contribution is the isolation of "continuation framing" from "harmful content exposure" by holding the latter fixed while varying the former across demonstrations, documents, assistant histories, and tool outputs. This controlled factorial design is sophisticated and directly addresses a confound in prior safety literature. The use of paired interventions, strict domain exclusion, and multiple prompt templates strengthens the internal validity of the causal claims. The integration of mechanistic analysis (activation steering) adds depth, although the primary contribution remains behavioral.
The experimental evaluation is extensive and robust. The authors conduct a multi-model sweep (Gemini, Grok, GPT, Claude, Qwen, Mistral) and find model-dependent effects, which is a significant finding. They employ rigorous statistical methods, including two-way cluster bootstrapping and exact sign-flip tests, to account for dependencies in the data. The inclusion of blinded human audits to validate the LLM judge's performance is a strong point, addressing the known bias of automated evaluators. The results are consistent across various robustness checks (strict subsets, semantic clustering, new questions).
The paper provides a high degree of reproducibility. The authors release code, data manifests, prompt hashes, and cached outputs for closed-model runs. The use of SHA-256 hashes for prompts and deterministic sampling rules ensures that other researchers can replicate the exact conditions. The detailed appendix on artifact provenance and the public release of the evaluation suite enhance trust in the results.
The study focuses primarily on specific frontier models (Gemini, Grok) and may not generalize to all model architectures or training regimes. The "strict" subset of questions, while useful for isolating transfer, reduces the sample size and may miss nuanced interactions in broader domains. The mechanistic analysis is limited to a smaller open-weight model (GPT-OSS-20B), which may not fully reflect the internals of the larger closed models where the primary effects are observed. Additionally, the reliance on LLM judges, despite human validation, introduces potential biases inherent in current evaluation frameworks.
This work has significant implications for the safety and alignment of LLMs, particularly in RAG and agent systems where context composition is common. By identifying that "continuation framing" is a key driver of emergent misalignment, it provides concrete guidance for prompt engineering and system design (e.g., distinguishing data from behavior in context windows). It challenges the assumption that harmful content exposure alone is sufficient for misalignment, suggesting that the *structure* of the context is equally critical. This could lead to more robust safety interventions and a better understanding of how models interpret and generalize from in-context examples. The paper makes a significant contribution to the field of AI safety by rigorously isolating the role of continuation framing in in-context emergent misalignment, providing robust empirical evidence and practical insights for safer LLM deployment.
Mixture-of-Experts (MoE) models decouple total parameters from per-token compute, but deployment still requires storing every expert. Recent theory shows that pruning experts with the smallest router-norm changes during fine-tuning can preserve accuracy, but assumes full fine-tuning. We test whether lightweight adaptation can recover this signal. We briefly fine-tune with a parameter-efficient adapter, rank experts by the induced $\ell_2$ router change, and prune the least-changed experts in one shot. On Mixtral-8$\times$7B-Instruct (44.83% MMLU-Pro), router-only LoRA trains 0.002% of parameters and outperforms all-module LoRA at matched rank with half the experts removed (27.54% vs. 24.42%); signal quality declines as adaptation spreads to attention and expert weights. Accuracy improves monotonically with LoRA rank, reaching 28.76%. IA3, which leaves router weights frozen, matches direct router adaptation, whereas unconstrained additive adapters degrade the signal. Router-guided MMLU-Pro accuracy decays quasi-linearly rather than collapsing, remains nearly 1.8 times that of magnitude-based or random pruning at maximal compression, and reduces memory by 49% and per-token latency by 37%. At 25% compression, retention is competitive with methods using full activation statistics. The criterion also transfers to Qwen1.5-MoE fine-tuned for mathematics, retaining 49.7% mean accuracy over eleven benchmarks with half the experts removed while random pruning falls to single digits. Router sensitivity under lightweight fine-tuning therefore makes provably motivated expert pruning practical at scale.
Primary: Columbia University
All Institutions: Columbia University, Data Science Institute, Department of Computer Science
Router sensitivity under lightweight fine-tuning provides a practical, high-fidelity signal for pruning MoE experts, bridging the gap between theoretical guarantees and scalable deployment. The paper makes a significant contribution to the field of model compression and efficient LLM deployment by demonstrating that PEFT can serve as an effective "instrument" for identifying redundant experts, offering a compelling alternative to static pruning heuristics and expensive full-fine-tuning-based selection.
The paper proposes a novel, efficient method for pruning Mixture-of-Experts (MoE) models by leveraging the sensitivity of router weights during lightweight parameter-efficient fine-tuning (PEFT). Instead of full fine-tuning, which is computationally prohibitive for determining expert importance, the authors use a small adapter (LoRA, IA3, or Houlsby) to perturb the model and measure the induced change in router norms or logits. Experts with the smallest changes are pruned. The methodology is well-grounded in recent theoretical work (Chowdhury et al.) but extends it to practical, large-scale language models (Mixtral-8x7B, Qwen1.5-MoE). The analysis of how different adapter geometries (additive vs. multiplicative) and target modules affect the quality of the pruning signal is rigorous and insightful.
The experimental evaluation is comprehensive and convincing. The authors test on two distinct MoE architectures (Mixtral and Qwen) and multiple benchmarks (MMLU-Pro, GSM8K, ARC, BBH, etc.). They demonstrate that router-only LoRA is the most effective adapter for eliciting the pruning signal, outperforming full-module LoRA and other adapters. The results show quasi-linear accuracy decay rather than catastrophic collapse, allowing for predictable compression. The comparison against state-of-the-art one-shot pruning methods (REAP, DiEP, etc.) shows competitive performance, particularly on challenging benchmarks like MMLU-Pro where prior work lacked evaluation. The inclusion of deployment metrics (memory, latency) strengthens the practical relevance.
The paper provides detailed implementation details, including hyperparameters, hardware specifications, and evaluation protocols. The authors state that configurations and pruned checkpoints are released, which significantly aids reproducibility. The use of standard libraries (PEFT, TRL, LightEval) and open-source models further enhances reproducibility. The measurement resolution analysis adds credibility to the reported differences.
The method requires a brief fine-tuning step, which, while cheaper than full fine-tuning, is still more expensive than purely static, training-free pruning methods. The quality of the pruning signal is dependent on the adaptation task; a generic corpus may not preserve domain-specific capabilities (e.g., arithmetic) as well as a domain-specific corpus. The paper acknowledges that the theoretical guarantees were established for simplified settings and binary classification, so the empirical nature of the results on large LLMs is an extrapolation. The Qwen experiments were conducted on a pre-reduced version of the model due to memory constraints, which is a minor limitation in terms of direct comparison to the original 60-expert model.
This work makes MoE models more accessible by reducing their memory footprint and inference latency without significant accuracy loss. This can democratize access to large language models on constrained hardware. The insights into adapter geometry and router sensitivity also contribute to the broader understanding of how PEFT methods interact with MoE architectures, which could inform future model design and training strategies. Router sensitivity under lightweight fine-tuning provides a practical, high-fidelity signal for pruning MoE experts, bridging the gap between theoretical guarantees and scalable deployment. The paper makes a significant contribution to the field of model compression and efficient LLM deployment by demonstrating that PEFT can serve as an effective "instrument" for identifying redundant experts, offering a compelling alternative to static pruning heuristics and expensive full-fine-tuning-based selection.
Large language models (LLMs) are increasingly reported to exhibit human-like neural and cognitive signatures, including concept cells, mental number lines, and cognitive maps. These claims often rely on linear probing and activation steering applied to a single model, yet both methods are highly sensitive to measurement choices. A reported parallel may therefore reflect the model, the measurement procedure, or both. We audit four representative neuroscience-inspired paradigms across 17 models from five families, spanning $0.6$B to $72$B parameters. Our main experiment examines the causal steerability of concept directions. With raw activation units and a fixed layer and coefficient, steerability appears to increase with model scale, resembling an emergent capability. However, this pattern is produced by an uncalibrated pipeline rather than by a claim established in the steering literature. The trend depends jointly on raw units, the readout metric, and the operating point; correcting any one of these removes it. With residual-norm-comparable interventions and held-out operating-point selection, concept steering remains significant at every scale, but shows no significant trend across the Qwen3 series, although the confidence interval does not rule out a moderate positive slope. The remaining results are mixed. A linear geographic world map is consistently decodable in every tested checkpoint up to $72$B. Number magnitude is strongly encoded, but whether individual neurons appear bell-shaped or monotonic depends on the selection criterion. Language-specific structure is localizable, but the direction of the cross-lingual asymmetry reverses under a different attribution method. These results suggest that the main constraint on AI neuroscience is not a lack of phenomena, but a lack of comparable measurements and adequate controls. We release the protocol, stimuli, and code.
Primary: Fudan University
All Institutions: Fudan University
This paper provides a critical audit of "AI neuroscience" claims in LLMs, demonstrating that many reported parallels (e.g., emergent steerability) are artifacts of measurement choices, and establishes a rigorous protocol for future interpretability research.
The paper employs a rigorous audit methodology to evaluate claims of "AI neuroscience" in Large Language Models (LLMs). It systematically tests four paradigms (concept steering, geographic maps, number magnitude, language localization) across 17 models from 5 families. The core methodological contribution is the identification and correction of measurement confounds in activation steering, specifically the lack of residual-norm normalization and the use of fixed, arbitrary operating points (layer/strength). The authors propose a standardized protocol involving held-out selection, residual-norm comparable interventions, and strict specificity/null controls. This approach is methodologically sound and addresses a critical gap in the interpretability literature where results are often sensitive to hyperparameter choices.
The experimental scope is impressive, covering a wide range of model sizes (0.6B to 72B) and families (Qwen, Llama, Mistral, Phi, Gemma). The results are robust and well-controlled. Key findings include: (1) The apparent "emergence" of concept steerability with scale is an artifact of uncalibrated intervention units; (2) Geographic maps are consistently decodable; (3) Number magnitude is encoded, but the shape (monotonic vs. bell) depends on selection criteria; (4) Language localization is attribution-dependent. The statistical analysis is thorough, using bootstrap confidence intervals and multiple null baselines. The quantization control further strengthens the validity of the large-model results.
The authors explicitly state that they release the protocol, stimuli, and code. The paper provides detailed descriptions of the models, intervention methods, and statistical procedures. The inclusion of a code repository link (though anonymous) and the detailed methodology section ensure that the audit can be replicated and extended by other researchers. The use of open-weight models also aids reproducibility.
The densest scale analysis is limited to the Qwen lineage up to 14B, with larger models using coarser grids. The steering analysis is limited to a specific set of 24 concepts. The authors acknowledge that the absence of a significant steering trend should be interpreted as "no detectable trend" rather than evidence of no trend, due to power limitations. Additionally, the study focuses on representational phenomena rather than dynamical ones.
This paper has significant implications for the field of mechanistic interpretability and AI neuroscience. It challenges the validity of many existing claims about LLMs exhibiting human-like neural signatures, emphasizing the need for rigorous controls and comparable measurements. By releasing the audit protocol, the authors provide a tool for future research to avoid similar pitfalls. This work promotes a more scientific and rigorous approach to understanding LLM internals, potentially shifting the field away from anecdotal findings toward robust, reproducible science. This paper provides a critical audit of "AI neuroscience" claims in LLMs, demonstrating that many reported parallels (e.g., emergent steerability) are artifacts of measurement choices, and establishes a rigorous protocol for future interpretability research.
Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries---largely invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSEs): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 24 models from 11 families (1.5B--1T parameters). First, every tested model is susceptible (20--100% on the 20-model susceptibility panel), with name binding as the necessary and dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment: preference contamination persists undecayed on every model probed (100% at t=10) and instruction contamination persists wherever adopted, persona-style injection decays partially (90%$\to$10%), while factual injection is model-dependent---self-corrected on Llama-3.1-8B and GPT-4o-mini but held at ceiling on both Qwen2.5-coder variants, so we do not claim it self-corrects in general. The preference and instruction results hold across providers in our controlled setting. Third, context-isolated self-verification achieves 20--79% reduction (median 36.5%) without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 1.9$\times$ along a four-stage agent pipeline (40%$\to$75%). Preference and instruction contamination---persistent, lacking self-correction, and poorly captured by standard monitoring---represent a particularly concerning attack surface for deployed agent systems.
Primary: University of Southern California
All Institutions: University of Southern California
[One sentence main contribution]. The paper formalizes Persistent Semantic Entities (PSEs) and provides a comprehensive empirical analysis of their prevalence and impact across 24 LLM families, revealing critical security vulnerabilities in tool-augmented agent systems. [Comprehensive analysis of the technical contribution, methodology, and significance to the field]. The work is a timely and important contribution to the field of LLM security, particularly as agent-based systems become more prevalent. The taxonomy of PSEs is a novel conceptual contribution that helps structure future research and development in this area. The empirical results are robust and surprising, challenging the assumption that LLMs are inherently stateless or that standard context management is sufficient to prevent contamination. The finding that preference contamination is persistent and undecayed is a major red flag for safety. While the paper does not propose a groundbreaking new architecture, its diagnostic value is high, and it sets the stage for future work on robust agent design. The score of 78 reflects its high relevance and strong empirical findings, placing it in the top tier of security-focused ML papers, though it lacks the methodological novelty of a new algorithm.
The paper introduces the concept of Persistent Semantic Entities (PSEs) to describe implicit state in tool-augmented LLM agents. The methodology involves a systematic evaluation of 24 models across 11 families to measure susceptibility to state persistence, contamination types (preference, instruction, persona, factual), and propagation across agent boundaries. The approach is empirical and observational, focusing on characterizing the phenomenon rather than proposing a new architectural solution. The definition of PSEs (name binding, event triggering, cross-boundary propagation) provides a useful taxonomy for analyzing agent security.
The experimental setup is rigorous, covering a wide range of model sizes (1.5B to 1T parameters) and providers. The results are significant: 100% susceptibility to preference contamination, partial decay for persona injection, and model-dependent behavior for factual injection. The finding that context-isolated self-verification reduces contamination by 20-79% is a strong practical insight. The evaluation of a four-stage agent pipeline showing 1.9x compounding of contamination is particularly valuable for understanding real-world risks.
The paper specifies the models tested and the types of contamination used. However, the exact prompts and tool definitions used to induce the PSEs are not fully detailed in the abstract, though likely present in the full text. The controlled setting mentioned suggests a standardized benchmark, which aids reproducibility. The claim of "no oracle references" for self-verification implies a specific evaluation protocol that needs clear definition to be fully reproducible.
The study is primarily diagnostic; it identifies the problem and measures its severity but offers limited novel mitigation strategies beyond "context-isolated self-verification," which is a known technique. The generalizability of the "self-correction" findings for factual injection is limited by the specific models tested (Llama-3.1-8B, GPT-4o-mini, Qwen2.5-coder). The paper does not explore the underlying cognitive or architectural reasons for these phenomena in depth, leaving the "why" partially unanswered.
This paper has significant implications for the security and reliability of deployed LLM agent systems. By formalizing PSEs, it provides a framework for developers to audit and mitigate risks associated with implicit state. The findings warn against the assumption that LLMs are stateless or that standard context windows prevent cross-session contamination. This is crucial for industries relying on autonomous agents for decision-making. [One sentence main contribution]. The paper formalizes Persistent Semantic Entities (PSEs) and provides a comprehensive empirical analysis of their prevalence and impact across 24 LLM families, revealing critical security vulnerabilities in tool-augmented agent systems. [Comprehensive analysis of the technical contribution, methodology, and significance to the field]. The work is a timely and important contribution to the field of LLM security, particularly as agent-based systems become more prevalent. The taxonomy of PSEs is a novel conceptual contribution that helps structure future research and development in this area. The empirical results are robust and surprising, challenging the assumption that LLMs are inherently stateless or that standard context management is sufficient to prevent contamination. The finding that preference contamination is persistent and undecayed is a major red flag for safety. While the paper does not propose a groundbreaking new architecture, its diagnostic value is high, and it sets the stage for future work on robust agent design. The score of 78 reflects its high relevance and strong empirical findings, placing it in the top tier of security-focused ML papers, though it lacks the methodological novelty of a new algorithm.
Safety alignment in multilingual models is uneven: a model that reliably refuses a harmful request in English will often comply with the same request in a lower-resource language. We trace this gap mechanistically in sarvam, an Indic-multilingual mixture-of-experts reasoning model, and find it is not a failure to detect harm. Harm is encoded as an internal direction that is nearly language-invariant in mid-network (English-vs-Indic cosine ${\approx}0.9$ at $L11$), and steering that direction upstream causally controls refusal. But the detection direction is orthogonal to the change that actually writes the refusal, which is late and assembled over the course of generation rather than read off in a single forward pass. We attribute the write to a specific, localizable circuit, a mixture-of-experts writer held in check by an attention opposer and price every way of intervening on it: damping the opposer is cheap and effective, amplifying the writer is a cost wall, and surgical edits to the responsible heads do nothing. The circuit's organization, and the gradient method that exposes it, recur in a second, unrelated MoE model, while the lever's strength is architecture-specific. The result is a cost-measured map of where a multilingual safety repair can land, and what it costs
Primary: Godel Machines
All Institutions: Godel Machines
The paper makes a significant contribution to mechanistic interpretability by localizing the cross-lingual safety gap in MoE models to a late-generation circuit, demonstrating that safety repairs can be achieved by damping specific attention heads rather than amplifying refusal signals, a finding that is both theoretically insightful and practically actionable for improving multilingual model safety.
The paper employs a rigorous mechanistic interpretability pipeline on a specific MoE model (sarvam2025). It correctly identifies a dissociation between the "detection" direction (mid-network, language-invariant) and the "refusal write" direction (late-network, orthogonal). The methodology involves activation addition steering, Direct Logit Attribution (DLA), and gradient-activation attribution to localize the circuit. The core finding—that refusal is a generative process over the autoregressive trajectory rather than a static readout—is theoretically significant for understanding MoE dynamics. The "pricing" of interventions (damping opposer vs. amplifying writer) is a novel analytical framework for safety alignment.
The experiments are well-controlled, comparing English vs. Indic languages and using a second model (Qwen3) for transfer checks. The results are consistent: damping the attention opposer is cheap and effective, while amplifying the writer is costly and inefficient. The cross-model transfer of the *organization* (writer/opposer structure) but not the *lever strength* is a key empirical contribution. However, the evaluation relies heavily on an LLM judge for safety labels, which is a known weakness, though the authors acknowledge this. The sample sizes for some interventions (e.g., writer amplification) are small, introducing noise.
The paper provides detailed setup information, including model parameters, data sources (TwinBreak corpus), and specific intervention methods. It mentions ancillary files for reproducibility. The use of standard interpretability tools (DLA, activation addition) enhances reproducibility. The reliance on a specific "sarvam2025" model and a custom "TwinBreak" corpus may limit immediate replication by those without access to these specific resources, but the methodology is generally applicable.
The authors explicitly list several limitations: (1) The findings are primarily based on a reasoning model with `
This work has significant implications for the safety of multilingual LLMs. By identifying that safety failures in lower-resource languages are due to execution bottlenecks rather than detection failures, it provides a clear path for targeted interventions (damping the opposer) that are more efficient than retraining or broad alignment. It also highlights the risk of cross-lingual vulnerabilities in multilingual deployments. The paper makes a significant contribution to mechanistic interpretability by localizing the cross-lingual safety gap in MoE models to a late-generation circuit, demonstrating that safety repairs can be achieved by damping specific attention heads rather than amplifying refusal signals, a finding that is both theoretically insightful and practically actionable for improving multilingual model safety.
Recent systems for optimizing prompts, programs, and ML workflows typically rely on explicit outer-loop controllers such as evolutionary search, bandits, or textual-gradient methods. We ask a fundamentally different question: how much of this search policy can be internalized by a single tool-using agent? We present ReASearch, a unified framework for reasoning-driven optimization in which the agent autonomously decides what to evaluate, how to diagnose failures, which edits to make, and when to verify or restart. Rather than serving only as a proposal generator guided by hand-designed heuristics, the agent actively analyzes outcomes, allocates budget, and refines its strategy over long horizons through persistent memory. With a shared agent loop and domain-specific tools, ReASearch instantiates the exact same scaffold to optimize prompts, programs, and ML workflows. Across 14 diverse tasks, it is competitive with and mostly better than specialized optimization systems, achieving gains of 2% to 40% over strong domain-specific baselines, and in some cases discovering solutions that improve on prior human best-known results. Crucially, we observe that complex search behaviors, which are typically implemented by explicit controllers, emerge naturally from the agent's reasoning process.
Primary: The University of Texas at Austin
All Institutions: The University of Texas at Austin, Snowflake
The paper presents ReASearch, a unified, reasoning-driven agentic framework that internalizes complex search policies previously handled by explicit controllers, demonstrating competitive or superior performance across 14 diverse optimization tasks in prompts, programs, and ML workflows.
The paper proposes ReASearch, a unified framework that replaces explicit, hand-designed outer-loop controllers (such as evolutionary algorithms, bandits, or Bayesian optimization) with a single, persistent, tool-using LLM agent. The core methodological contribution is the formulation of optimization as a sequential reasoning problem where the agent autonomously decides evaluation strategies, diagnoses failures, and manages memory across long horizons. The architecture is domain-agnostic, relying on a shared scaffold with domain-specific tool sets for prompt optimization, program evolution, and ML workflow tuning. The approach leverages persistent memory (lessons.md) and context compression to maintain state, allowing the agent to "learn" from past failures and successes without external algorithmic guidance. This represents a significant shift from "LLM as optimizer" to "LLM as the search policy itself."
The evaluation is comprehensive, spanning 14 diverse tasks across three categories: prompt optimization (AIME, HotpotQA, GSM8K, Terminal-Bench), program evolution (Circle Packing, Heilbronn Triangles, EPLB, TXN, ARC-AGI-2), and ML workflow optimization (NanoGPT, IMG-100, Atari, MuJoCo, Kaggle Crypto). ReASearch is compared against strong, specialized baselines including GEPA, AdaEvolve, and Claude Code (AutoResearch). The results are compelling: ReASearch matches or exceeds specialized systems, achieving gains of 2-40%. Notably, it discovers solutions improving upon human best-known results in geometric optimization (Heilbronn, Circle Packing) and significantly outperforms generalist code agents in ML workflow tuning. The analysis of agent trajectories provides qualitative evidence of emergent optimizer behaviors (e.g., double-verification, revert-based recovery, hypothesis-driven revision), supporting the claim that reasoning can internalize search logic.
The paper provides detailed descriptions of the tool sets, memory mechanisms, and experimental settings. It includes ablation studies on memory and Python execution capabilities. However, the reliance on proprietary models (Claude Sonnet 4.6, GPT-5, GPT-4.1 mini) for both the agent and student models limits full reproducibility of the specific performance numbers, although the framework itself is described in sufficient detail to be implemented. The use of standard benchmarks (AIME, ARC-AGI-2, etc.) aids in future comparative evaluation.
The approach is computationally expensive due to the high cost of LLM reasoning and tool calls, although the authors argue it is competitive in API costs with specialized methods. The performance is heavily dependent on the capability of the underlying frontier LLM; the paper notes that open-source models (GLM-5, Kimi-2.5) perform well but still trail behind the proprietary baselines, suggesting a ceiling on current open-source reasoning capabilities for this task. The "black box" nature of the agent's reasoning, while analyzed qualitatively, lacks the rigorous theoretical guarantees of traditional optimization methods.
This work has significant implications for the field of Agentic ML, suggesting that complex search policies need not be hard-coded but can emerge from general reasoning capabilities. It democratizes access to sophisticated optimization by providing a unified scaffold that works across domains, potentially reducing the engineering burden of building domain-specific optimizers. It also highlights the potential of LLMs to act as scientific discoverers, as evidenced by the geometric optimization results. The paper presents ReASearch, a unified, reasoning-driven agentic framework that internalizes complex search policies previously handled by explicit controllers, demonstrating competitive or superior performance across 14 diverse optimization tasks in prompts, programs, and ML workflows.
The Tower of Hanoi is a simple planning puzzle that in prior work has proven challenging for large reasoning models (LRMs). Current models solve the standard formulation of the puzzle, but still struggle with the flat-to-flat variant (where initial and goal states are not restricted to have all rings on a single peg). This paper presents an in-depth study of how both small, in-house Transformers and large, third-party LRMs solve this task. To understand the failures mechanistically, we first train small Transformers from scratch on precomputed solution traces. Using a variety of interpretability techniques, we show that these Transformers develop an emergent world model: a linearly decodable, geometrically faithful representation of the puzzle's state space (the Sierpinski triangle), that is causally involved in solving the puzzles. Second, we return to the large LLMs and apply our techniques to two frontier reasoning models, Qwen3.6-27B and DeepSeek-R1-Distill-Qwen-32B, that attempt to solve the task through extended chain-of-thought. Surprisingly, we find that both models encode the Sierpinski world model near-perfectly at the end of the prompt, and yet fail at the majority of tasks when there are more than 3 rings. We locate the source of this failure in the decaying representation of the world model. We probe for the representation at different stages during planning, and establish causality by showing that performance can be improved by injecting the prompt-time representation at inference. The failure of the models is thus one of maintenance of the required representations, not their absence, and performance is at least partially recoverable. These results thus reframe the reported collapse in performance from prior work: current Large Reasoning Models build a world model, and then lose it.
Primary: University of Amsterdam
All Institutions: University of Amsterdam
This paper provides a compelling mechanistic explanation for the "illusion of thinking" in large reasoning models, demonstrating that they build accurate world models but fail to maintain them during generation, and that restoring these representations can partially recover performance.
The paper employs a rigorous mechanistic interpretability toolkit, combining linear probing, activation patching, and activation steering. The methodology is sound and well-executed. The core innovation lies in the application of these techniques to large reasoning models (LRMs) on a planning task, specifically tracking the degradation of internal representations during chain-of-thought generation. The use of a "distance-matching probe" to recover the Sierpinski triangle geometry of the Tower of Hanoi state space is a clever and effective diagnostic tool. The causal interventions (patching and steering) are appropriately designed to move beyond correlation.
The experiments are extensive and compelling. The authors demonstrate that both small Transformers and large LRMs (Qwen3.6-27B, DeepSeek-R1-Distill-Qwen-32B) encode the world model faithfully at the prompt stage. They then show that this representation degrades during generation, correlating with performance collapse. The steering experiments provide strong causal evidence: restoring the prompt-time representation improves performance for Qwen3.6-27B. However, the results for DeepSeek are mixed, with the intervention failing to significantly improve performance due to output format issues. This asymmetry is an interesting finding but also a limitation in terms of generalizability of the mitigation strategy. The baseline comparisons are adequate, though the field is moving fast, and "2025/2026" citations suggest this is very recent work.
The paper provides sufficient detail for reproduction. The model architectures (Qwen3.6-27B, DeepSeek-R1-Distill-Qwen-32B) are open-weight. The probing and steering methods are standard in the interpretability community. The external state tracker is described clearly. The reliance on specific prompts from prior work (shojaee2025illusion) is noted. The code is likely available given the nature of the work (master thesis based), but no URL is provided in the text.
The primary limitation is the scope of the task. Tower of Hanoi is a highly structured, geometric problem. It is unclear if the "degradation" phenomenon generalizes to less structured reasoning tasks (e.g., math proofs, code generation). The steering intervention relies on an external symbolic tracker, which is not scalable to all domains. The mixed results for DeepSeek suggest that the failure mode is not uniform across models or that the steering method is sensitive to model-specific representation codes. The paper acknowledges these limitations.
This work has significant implications for understanding the reliability of Large Reasoning Models. It challenges the assumption that if a model "knows" the answer (or the state), it can reliably output it. It suggests that the bottleneck is often maintenance of internal state rather than initial comprehension. This could guide future research into better memory mechanisms, attention patterns, or training objectives that encourage stable representation maintenance. It also highlights the importance of interpretability in diagnosing failures in complex AI systems. This paper provides a compelling mechanistic explanation for the "illusion of thinking" in large reasoning models, demonstrating that they build accurate world models but fail to maintain them during generation, and that restoring these representations can partially recover performance.
In overparameterised classification, training data can be linearly separable even when the underlying distribution is not. In this setting, gradient descent (GD) on the logistic loss diverges in norm while converging in direction to a max-margin interpolating classifier, whose implicit bias can be statistically suboptimal. In this work, we show that early stopping can overcome this suboptimality: in a Gaussian mixture model with label-flipping noise, GD stopped at an appropriate oracle time achieves minimax-optimal excess zero-one risk for covariance spectra with fast and continuous decay, including polynomial and exponential spectral decays. Our analysis combines a sharp upper bound for the early-stopped iterate with a matching statistical lower bound over arbitrary classifiers, yielding optimal rates that are validated by experiments. A central technical contribution is a new calibration result that converts excess logistic risk into excess zero-one risk; it handles the model misspecification induced by the label-flipping noise, and removes the square-root rate in standard bounds. We also establish a lower bound for linear interpolators, showing that interpolation can require exponentially more samples than early stopping to achieve the same excess risk.
Primary: University of Oxford
All Institutions: University of Oxford
The paper presents a rigorous theoretical analysis demonstrating that early-stopped gradient descent achieves minimax-optimal excess zero-one risk in Gaussian mixture models, outperforming max-margin interpolators by a significant margin in sample complexity.
The paper addresses a fundamental tension in overparameterized classification: the statistical suboptimality of max-margin interpolators (implicit bias of GD) versus the potential benefits of early stopping. The methodology is theoretically rigorous, focusing on a Gaussian Mixture Model (GMM) with label-flipping noise. The core technical contributions are twofold: (1) deriving sharp upper bounds on the excess zero-one risk of early-stopped Gradient Descent (GD) for covariance spectra with fast decay (polynomial/exponential), and (2) establishing a novel calibration result that converts excess logistic risk to excess zero-one risk, effectively removing the square-root rate penalty typical in standard bounds under model misspecification. The authors also prove a lower bound for linear interpolators, demonstrating an exponential sample complexity gap compared to early-stopped GD. This is a significant theoretical advance in understanding the implicit regularization of GD in classification settings.
The abstract mentions that the optimal rates are validated by experiments. Given the theoretical nature of the work, the experiments likely serve to corroborate the derived rates in synthetic GMM settings. While the theoretical results are strong, the lack of extensive empirical validation on real-world datasets or more complex models (e.g., deep networks) limits the immediate practical impact, though this is common for high-theory papers. The validation of the "oracle time" stopping criterion is crucial; if the experiments show that this time is practically estimable or robust, the impact increases. However, the abstract implies an "oracle time," which may limit direct applicability without further algorithmic development.
The paper provides a full theoretical derivation with appendices for proofs. The notation is standard. Reproducibility of the theoretical claims is high for other theorists. Reproducibility of the empirical claims depends on the code availability, which is not explicitly linked in the provided text (URLs are "none"), but the mathematical framework is self-contained.
The primary limitation is the reliance on the "oracle time" for early stopping. In practice, knowing the optimal stopping time requires knowledge of the underlying distribution or validation data, which may not be available. The paper establishes a lower bound for interpolators, but does not provide a practical algorithm to find the optimal early stopping point without oracle knowledge. Additionally, the analysis is restricted to linear classifiers on Gaussian mixtures, which, while a canonical model, does not directly translate to non-linear deep learning settings without further bridging theory.
This work provides a rigorous theoretical justification for the use of early stopping in classification, a heuristic widely used in practice but poorly understood theoretically in the context of interpolation. It clarifies why max-margin solutions can be suboptimal and how early stopping mitigates this. This contributes to the broader field of algorithmic stability and implicit regularization, potentially guiding the design of better training procedures for overparameterized models. The paper presents a rigorous theoretical analysis demonstrating that early-stopped gradient descent achieves minimax-optimal excess zero-one risk in Gaussian mixture models, outperforming max-margin interpolators by a significant margin in sample complexity.
Quantization is how large language models are actually deployed, and below four bits it is known to hurt. What nobody can say is which of the model's decisions will change at a given bit-width. The damage is silent: a compressed agent stops calling its tools, then loses half its safety refusals, yet benchmark scores barely move. Prior work assumes quantization adds noise of a roughly fixed size, which would make confident decisions safe. We measure the decision itself instead. The margin of a two-way decision is the model's score for the option it picks minus the score of its best alternative; we track it before and after quantization across 16 models from 8 model families, three quantization methods, and bit-widths from 8 down to 2. Quantization does not add fixed-size noise to the margin. It multiplies the margin by a factor that collapses with bit-width (median 0.86 at 4 bits, 0.33 at 3, 0.00 at 2); we call this margin shrinkage. This contraction reduces the protection a large margin affords; the model's own small biases pick the direction of failure: at 3 bits the decision to call a tool collapses toward inaction while the choice of which tool is untouched. In fitted statistical comparison, additive-noise accounts never win on the damaged tool and safety decisions. The fitted relation predicts flip rates within a median of 1.8 percentage points on held-out decisions, though no flip was used in the fit; per decision, the predicted flip probabilities are calibrated uncertainty estimates (expected calibration error 0.004 over 131,758 predictions). The same form holds in every model we measure, but the constants are each model's own and do not transfer. A small paired margin set, measured per model and bit-width, estimates which decisions break without full generative evaluation; under our cost-matched tests, nothing repairs damage more cheaply than one more bit.
Primary: University College London
All Institutions: University College London
The paper provides a compelling empirical refutation of the additive noise hypothesis for quantization, establishing "margin shrinkage" as the dominant failure mode and demonstrating its profound implications for the reliability and safety of compressed large language models.
The paper employs a rigorous empirical methodology, shifting the focus from aggregate benchmark scores to per-decision margin analysis. By measuring the logit difference between the chosen and best alternative tokens before and after quantization, the authors establish a clear statistical model ("margin shrinkage") that contradicts the prevailing "additive noise" hypothesis. The methodology is sound, involving a large sweep across 16 models, 3 quantization methods, and multiple bit-widths. The use of Bayesian Information Criterion (BIC) to compare additive vs. multiplicative models provides a robust statistical foundation for their primary claim. The approach is novel in its granularity and its direct challenge to established intuitions about quantization error propagation.
The experimental evaluation is extensive and convincing. The authors cover a wide range of model families and quantization techniques (RTN, GPTQ, GGUF). The results consistently show that margins shrink proportionally rather than being perturbed by fixed noise. The paper provides strong evidence for the "margin shrinkage" law, including a fit-free bound on error accumulation and a predictive model for flip rates that achieves high calibration accuracy (ECE 0.004). The analysis of specific failure modes (tool calling vs. tool selection, safety refusals) adds significant depth. The comparison with additive models is thorough, and the identification of exceptions (e.g., code tokens) demonstrates scientific honesty. The finding that importance-based weight protection fails to repair damage is a critical empirical result that challenges current best practices.
The paper includes a detailed reproducibility statement, mentioning checked-in scripts and a collection of result files. The test sets are author-constructed and released with the artifact. The experimental setup is described in sufficient detail to allow replication. The use of standard quantization methods (GPTQ, llama.cpp) ensures that the technical components are accessible. The code and data availability is explicitly stated, which is a strong point for reproducibility.
The paper acknowledges several limitations. The analysis is restricted to post-training quantization and first-token decisions. The "margin shrinkage" constants do not transfer across models, limiting the generalizability of the specific parameters, although the form of the law appears universal. The study focuses on weight quantization, though it also touches on activation quantization. The "one more bit" conclusion, while practically true in the tested regime, is somewhat tautological given the cost-benefit trade-off of quantization. The mechanism explaining *why* shrinkage occurs (e.g., attention re-routing) is correlated but not definitively proven as the sole cause.
This paper has significant implications for the deployment of quantized LLMs. By demonstrating that quantization damage is multiplicative, it invalidates the assumption that confident decisions are safe, which has consequences for safety alignment and reliability in agentic systems. The finding that importance-based protection is ineffective suggests a need for new repair strategies, potentially focusing on activation precision or bit allocation rather than weight sparsity/importance. The work encourages a shift in evaluation metrics from aggregate benchmarks to decision-level margin analysis, which could become a standard practice for assessing quantization robustness. The paper provides a compelling empirical refutation of the additive noise hypothesis for quantization, establishing "margin shrinkage" as the dominant failure mode and demonstrating its profound implications for the reliability and safety of compressed large language models.
Pruning reduces the inference cost of large language models, but existing criteria primarily preserve large activations or reconstruct layer outputs. We argue that this overlooks a key computation performed by particularly sparsity-sensitive neurons in the MLP up and gate projections: separating similar inputs into dissimilar outputs. This suggests that effective pruning should preserve not only activations, but also the differences between outputs more broadly. We introduce a family of difference-informed pruning methods built upon this principle. Wisp is a first-order, update-free method that scores weights using input-difference norms, and Wisp+ refines this score neuronwise using the input pairs each neuron separates most strongly. Finally, Whisper is a second-order method that uses a lightly regularized difference Hessian as its reconstruction objective. Across Llama 2 and 3.1 models from 7B to 405B parameters, our second-order variant consistently improves over strong reconstruction-based baselines, while our update-free variants improve over activation-aware baselines, especially in constrained settings. The improvements over Wanda and SparseGPT extend to structured sparsity, downstream evaluations, and other model families. Augmenting stronger techniques such as RIA and ALPS with our difference-informed criteria yields further improvements, shifting the overall accuracy-runtime frontier outward at negligible additional cost. These results suggest that preserving output differences is a broadly useful and composable signal for post-training LLM sparsification.
Primary: IBM
All Institutions: IBM, IST Austria, MIT
The paper presents a significant and well-executed contribution to the field of model compression, introducing a theoretically sound and empirically superior method for pruning LLMs based on output difference preservation.
The paper introduces a novel perspective on LLM pruning by shifting focus from preserving activation magnitudes or output reconstruction to preserving "output differences" (i.e., the model's ability to distinguish between similar inputs). The authors propose three methods: Wisp (first-order, update-free), Wisp+ (refined first-order), and Whisper (second-order, using a difference Hessian). The methodology is theoretically grounded, arguing that sparsity-sensitive neurons in MLP projections are critical for separating input distributions. The approach is distinct from existing activation-aware (e.g., Wanda) and reconstruction-based (e.g., SparseGPT) methods. The second-order method (Whisper) is particularly notable for its computational efficiency relative to standard Hessian-based pruning, leveraging a "lightly regularized difference Hessian."
The evaluation is comprehensive, covering Llama 2 and Llama 3.1 models ranging from 7B to 405B parameters. The results demonstrate that Whisper consistently outperforms strong reconstruction-based baselines, while Wisp/Wisp+ improve upon activation-aware baselines, especially in constrained sparsity settings. The paper also reports improvements when augmenting other advanced techniques (RIA, ALPS) with their criteria. The inclusion of structured sparsity and downstream task evaluations adds robustness. The results suggest a meaningful shift in the accuracy-runtime frontier.
The paper provides detailed descriptions of the algorithms (Wisp, Wisp+, Whisper). Given the standard nature of the models (Llama 2/3.1) and the pruning framework (likely built on existing tools like SparseGPT or similar), reproducibility is high. The authors likely provide code, though not explicitly linked in the text snippet, the methodological clarity is sufficient for replication.
The paper acknowledges limitations, likely related to the computational overhead of the second-order method compared to first-order, although it claims to be "lightly regularized." There may also be limitations regarding the generalizability to non-Transformer architectures or multimodal models, though the abstract suggests broad applicability. The "difference" metric might be sensitive to the choice of input pairs used to estimate the Hessian or norms.
This work contributes to the democratization of large language models by making them more efficient to deploy. By providing a new, effective pruning criterion, it helps reduce inference costs and energy consumption. The insights into "separating similar inputs" may also inform future research on model robustness and representation learning. The paper presents a significant and well-executed contribution to the field of model compression, introducing a theoretically sound and empirically superior method for pruning LLMs based on output difference preservation.
Language models differ in how safely they behave and these differences are measured by safety benchmarks. But aggregated benchmark scores are hard to trust and interpret, because benchmarks duplicate one another, correlate heavily, and models may sandbag when they detect evaluation. To address these issues, we draw on Item Response Theory (IRT), a statistical toolkit for measuring these latents from performance on items with inferred psychometric properties. We fit IRT models to eight safety benchmarks across 192 language models, the largest psychometric analysis of LLM safety evaluations to date, and contribute three results. First, we find that three interpretable factors of refusal strictness, truthfulness, and contextual harm explain most of the variance between models across benchmarks. Second, psychometrically selected items recover full benchmark scores with lower error than random subsets of the same size, and roughly ten adaptively chosen items suffice for several individual benchmarks, cutting evaluation cost by 97-99%. Third, IRT supports audits of individual models, showing that it can be used to detect naive sandbagging and changes of model behind APIs. Overall, we show IRT is a ready-made toolkit for reading, reducing, and auditing safety benchmarks, which we recommend frontier labs and evaluators adopt.
Primary: UK AI Security Institute
All Institutions: UK AI Security Institute, Department for Science, Innovation, and Technology, Supervised Program for Alignment Research
This paper presents a rigorous psychometric analysis of LLM safety benchmarks, demonstrating that IRT can effectively decompose safety into latent factors, distill evaluation costs, and detect behavioral anomalies, offering a valuable methodological advancement for the field.
The paper applies Item Response Theory (IRT), a well-established psychometric framework, to the domain of Large Language Model (LLM) safety evaluation. The methodology involves fitting Two-Parameter Logistic (2PL) IRT models to item-level responses from 192 models across eight safety benchmarks. The authors employ standard psychometric techniques, including factor analysis to identify latent safety traits (refusal strictness, truthfulness, contextual harm), Fisher information for item selection, and person-fit statistics for anomaly detection. The approach is methodologically sound and rigorously applied, utilizing regularization to handle the specific data sparsity characteristics of LLM evaluations (many items, fewer models). While the application of IRT to LLMs is not entirely new (citing prior work on capability benchmarks), its systematic application to the complex, multi-dimensional landscape of *safety* benchmarks, particularly for the purpose of distillation and auditing, represents a sophisticated and novel synthesis of psychometrics and AI safety.
The experimental setup is robust, leveraging a large-scale dataset of 5,255 items and 192 models. The results are compelling: the authors demonstrate that three latent factors explain the majority of variance, that psychometrically selected items can recover benchmark scores with significantly lower error than random subsets (cutting evaluation cost by 97-99%), and that IRT-based person-fit statistics can detect specific forms of sandbagging and API substitution. The use of held-out splits and comparison against random baselines strengthens the claims regarding benchmark distillation. The detection of "naive sandbagging" is a strong empirical finding, though the authors correctly note limitations regarding sophisticated, adversarial sandbagging.
The paper provides extensive details on the preprocessing, model fitting (including regularization priors), and evaluation metrics. The inclusion of a full model roster and benchmark coverage matrix in the appendix enhances transparency. The reliance on OpenRouter's API for data collection is a potential reproducibility hurdle for exact replication of the *collection* phase, but the analysis code and data package are mentioned as available in supplementary material, which is standard practice. The clear description of the 2PL model and factor analysis procedures allows for independent verification of the statistical claims.
The authors acknowledge several limitations. The cohort size (192 models) is large for LLM studies but smaller than traditional human psychometric datasets, which may affect the stability of parameter estimates. The sandbagging detection is evaluated on "prompted model organisms" rather than fine-tuned models, which may behave differently. The factor analysis relies on empirical loading patterns, and the interpretation of latent factors as distinct "abilities" requires further validation. Additionally, the method assumes that the benchmarks are measuring stable traits, which may be violated if models exhibit context-dependent safety behaviors not captured by the static items.
This work has significant implications for the AI safety community. By providing a rigorous statistical framework for interpreting safety benchmarks, it addresses critical concerns about the validity and reliability of current evaluation practices. The ability to distill benchmarks could make safety evaluation more efficient and accessible, while the auditing capabilities offer a new tool for detecting deceptive behavior or model substitution in API-based systems. The recommendation for frontier labs to adopt these psychometric standards could lead to more trustworthy and comparable safety assessments across the industry. This paper presents a rigorous psychometric analysis of LLM safety benchmarks, demonstrating that IRT can effectively decompose safety into latent factors, distill evaluation costs, and detect behavioral anomalies, offering a valuable methodological advancement for the field.
Multi-agent LLM systems relay key--value caches instead of text and credit their gains to exchanged ``latent thoughts''. That credit is a claim about \emph{which} example's cache is relayed, not merely that one is. We audit it causally in released systems. The cache is replaced with deranged (mismatched-example), zeroed, and moment-matched random counterparts, under two regimes defined by whether the receiver needs the sender's private information. Where it does, the battery reads ceiling: 100\% against 23--25\% for answer-irrelevant relays on the primary backbone, a contrast replicated across three families, five checkpoints, and a prose document-QA surface. Where it does not, a pre-registered five-seed protocol establishes equivalence within 2.8 points, a margin anchored to the audited system's reported gain, under Holm-corrected TOST on GSM8K and ARC-Challenge across three Qwen3 scales and on MedQA at 8B (one cell shows a small detected advantage inside the margin); a second family shows no detected advantage. A large cache effect need not be a pairing effect. In one natural cell, zeroing the relay costs 14.7 points; a mismatched cache, 0.4. Nor is need sufficient: under the same test, delivered channels span ceiling (LatentMAS's native relay), partial (KVComm's layer subset), and no detected example-specific transfer (C2C's released projector). Benchmark deltas do not by themselves establish latent-thought transmission; establishing it takes a mismatched-cache audit, which we release.
Primary: The Ohio State University
All Institutions: The Ohio State University
The paper provides a rigorous causal audit framework that debunks the "latent thoughts" attribution in popular multi-agent LLM systems, demonstrating that while latent channels can transmit information, they do not necessarily transmit example-specific content that improves performance on standard tasks, challenging the core value proposition of several recent systems.
The paper proposes a rigorous causal audit framework for multi-agent LLM systems that utilize latent communication (specifically KV-cache relaying). The core methodological innovation is the "derangement" intervention, which swaps the sender's KV cache with that of a mismatched example from the same batch, preserving the marginal distribution of the cache while breaking the semantic pairing. This is combined with zeroed and moment-matched random controls, and a "receiver-necessity" dissociation using procedurally generated sender-private information. The statistical approach employs pre-registered equivalence testing (TOST) with Holm correction, anchoring the equivalence margin to the audited system's own claimed gains. This moves the evaluation from simple benchmark delta comparisons to causal attribution of specific content transmission.
The evaluation is extensive and rigorous. It tests the audit on three released systems (LatentMAS, C2C, KVComm) across three model families (Qwen3, Mistral-Nemo, phi-4) and multiple checkpoints. The experiments cover both a "calibrated regime" (where the receiver cannot solve the task without the sender's private info) and a "natural regime" (standard benchmarks like GSM8K, ARC-Challenge, MedQA). The results are striking: in the calibrated regime, LatentMAS achieves ceiling performance (100% accuracy vs ~23% for controls), proving the channel works. In the natural regime, the audit finds no statistically significant advantage for the paired cache over the deranged cache, bounding the "pairing effect" below the system's claimed gain. This effectively debunks the claim that LatentMAS transmits useful "latent thoughts" in standard settings, suggesting the gains are likely due to interface effects or generic computation. The cross-system comparison (LatentMAS vs C2C vs KVComm) further demonstrates the portability of the audit.
The paper emphasizes reproducibility, mentioning a pre-registered analysis plan, frozen seed sets, and detailed statistical conventions. It claims to release the audit harness, calibration instrument, and run manifests. The use of standard benchmarks and released models enhances reproducibility. The detailed description of the derangement procedure and the statistical tests allows for independent verification.
The audit is limited to the specific configurations of the released systems; retrained or fine-tuned variants might behave differently. The calibrated regime relies on a specific type of procedurally generated registry; while a prose stress test was included, it may not cover all forms of latent communication. The audit measures example-pairing value, not the absolute value of the latent channel (which could still be useful for other reasons, though the paper argues against this for the "latent thoughts" claim). The results are specific to the models and tasks tested.
This paper has significant implications for the field of multi-agent LLMs. It provides a much-needed standard for evaluating latent communication mechanisms, moving beyond aggregate benchmark scores to causal attribution. It warns practitioners against crediting gains to "latent thoughts" without rigorous controls, potentially saving resources on ineffective architectures. It establishes a new benchmark for what constitutes evidence of content transmission in latent channels. The paper provides a rigorous causal audit framework that debunks the "latent thoughts" attribution in popular multi-agent LLM systems, demonstrating that while latent channels can transmit information, they do not necessarily transmit example-specific content that improves performance on standard tasks, challenging the core value proposition of several recent systems.
SciCode is the standard measure of the scientific-coding ability of language models: research-level problems that demand both frontier scientific theory and its implementation as working numerical code. It is a component of the Artificial Analysis Intelligence Index and a standing evaluation in government and national-laboratory suites. Yet its scores have recently plateaued: the strongest 2026 models cluster tightly around 60\% subproblem accuracy, and a successor model ties its predecessor. We trace this stagnation to defects in the benchmark itself. A per-problem, domain-expert audit of all 65 test problems uncovers 263 defects; 192 of them, spread across 91\% of the main problems, cause correct, instruction-following solutions to be wrongly rejected---through non-reproducible gold answers, over-tight tolerances, or self-contradictory specifications. Critically, 78\% of these score-suppressing defects require specialized physics or mathematics knowledge to detect, not mere clerical proofreading. We corrected every confirmable defect to produce SciCode-Verified. The corrections add only the specifications a well-posed problem requires, repair grading, and tighten the tests that were too lenient; every change is recorded with its justification and independently re-checked by a second domain expert. We re-evaluate twelve frontier model snapshots on the corrected benchmark and find a substantial recovery: subproblem accuracy rises from 45--60\% to 84--98\%, and main-problem accuracy from 9--27\% to 69--92\%. State-of-the-art models are far more proficient in scientific coding than SciCode has suggested---the bottleneck was not model capability, but the quality of the evaluation instrument. We release SciCode-Verified with its complete audit trail as the corrected public standard.
Primary: Chinese Academy of Sciences
All Institutions: Chinese Academy of Sciences, National Key Research and Development Program of China, National Natural Science Foundation of China, Quantum Science and Technology---National Science and Technology Major Project, Natural Science Foundation of Fujian Province
This paper presents a comprehensive and necessary correction to the SciCode benchmark, demonstrating that previous evaluations of language models' scientific coding abilities were significantly flawed due to benchmark defects. By releasing a rigorously audited and corrected version of the benchmark with a complete audit trail, it provides the field with a reliable tool for evaluating frontier models and sets a new standard for benchmark integrity in scientific AI.
The paper employs a rigorous, domain-expert-led audit methodology to identify and correct defects in the SciCode benchmark. The approach involves a multi-stage process: initial auditing by domain experts, adversarial re-review, and mechanical verification of corrections. The taxonomy of defects (scientific vs. surface, and direction of error) provides a structured framework for understanding benchmark degradation. The methodology is sound and addresses a critical gap in the reliability of automated evaluation for scientific coding tasks. The use of a "two-environment OR grading" mechanism to mitigate library version incompatibilities is a practical and robust addition to the evaluation protocol.
The experimental design is strong, featuring a matched before/after re-evaluation of twelve frontier model snapshots. The results are striking: subproblem accuracy increases from 45-60% to 84-98%, and main-problem accuracy from 9-27% to 69-92%. This dramatic shift effectively demonstrates that the previous benchmark scores were suppressed by artifacts rather than model capability. The analysis of specific failure modes (e.g., unspecified conventions, wrong gold values) is detailed and convincing. The inclusion of a "no-background" setting provides additional nuance regarding the models' ability to reconstruct derivations versus relying on provided scaffolding.
The paper excels in reproducibility. The authors release the corrected benchmark, the evaluation harness, and a complete audit trail (ledger) of every change with justification. The use of md5 checksums for data integrity and the release of per-step grading caches allow for independent verification. The mechanical checks and adversarial review process add layers of confidence to the corrections. The public repository provides all necessary components for the community to reproduce the results and potentially extend the audit.
The primary limitation is that the audit was conducted by the authors, who are also the creators of the benchmark (or closely affiliated), which may introduce bias, although the adversarial review process mitigates this to some extent. The authors acknowledge this in the limitations section. Additionally, the benchmark focuses on single-problem scientific coding rather than long-horizon agentic workflows, which is a recognized scope limitation. The small sample size of models evaluated (12) limits the statistical power of some comparative analyses, although the trends are clear.
This paper has significant broader impact by establishing a new standard for rigor in benchmark creation and maintenance. It highlights the critical importance of domain expertise in evaluating scientific AI systems and provides a template for how such audits should be conducted. By correcting the benchmark, it allows for more accurate tracking of model progress in scientific coding, which is crucial for guiding research and development in this high-stakes area. It also serves as a cautionary tale for other benchmark developers about the potential for silent degradation and the need for continuous verification. This paper presents a comprehensive and necessary correction to the SciCode benchmark, demonstrating that previous evaluations of language models' scientific coding abilities were significantly flawed due to benchmark defects. By releasing a rigorously audited and corrected version of the benchmark with a complete audit trail, it provides the field with a reliable tool for evaluating frontier models and sets a new standard for benchmark integrity in scientific AI.
Large language model agents are commonly trained through reinforcement learning with sparse trajectory-level rewards, which offer limited guidance on how strongly individual tokens should be updated. On-Policy Self-Distillation (OPSD) addresses this by re-scoring generated tokens under a privileged replay view to obtain dense, token-level supervision. However, we identify a confounding issue: the resulting support may reflect both the privileged information contained in the replay view and score shifts induced by the replay scaffold, making it difficult to attribute the support specifically to that information. This issue is especially pronounced when future environment observations serve as privileged information, since replaying them requires reconstructing an extended scaffold that itself perturbs token scores. To resolve this confounding, we propose Observation-Calibrated Self-Distillation (OCSD), which contrasts two structurally matched replay views, Full and Observation-Ablated, differing only in whether the actual future observation is present, to derive an observation residual that discounts score changes shared by the replay scaffold. OCSD then applies this residual to modulate token-level GRPO updates at high-uncertainty steps, while preserving the trajectory-level update direction. Experiments on ALFWorld, WebShop, and Search-QA across three Qwen3 model scales show that OCSD consistently outperforms strong baselines. Diagnostic analyses further confirm that the calibrated residual aligns better with local environment feedback. Our code is publicly available at https://github.com/yiy1x/OCSD.
Primary: Nanjing University
All Institutions: Nanjing University, Meituan
The paper presents a well-motivated and effective method for calibrating self-distillation signals in agentic RL, offering a clear solution to a previously underappreciated confounding issue.
The paper proposes Observation-Calibrated Self-Distillation (OCSD), a method designed to address a specific confounding issue in On-Policy Self-Distillation (OPSD) for agentic reinforcement learning. The authors argue that standard OPSD conflates the value of privileged future observations with the structural changes induced by the replay scaffold (e.g., added tokens, formatting). To disentangle these, OCSD introduces an "Observation-Ablated" view that preserves the scaffold but removes the actual future observation content. The difference between the Full view and the Ablated view yields an "observation residual," which is used to modulate token-level updates in GRPO. The methodology is theoretically sound and addresses a genuine attribution problem in hindsight distillation. The approach is relatively simple to implement, requiring only an additional forward pass for the ablated view, and integrates cleanly with existing RL frameworks.
The experimental evaluation is comprehensive, covering three distinct benchmarks (ALFWorld, WebShop, Search-QA) and three model scales (Qwen3-1.7B, 4B, 8B). The results show consistent improvements over strong baselines, including GRPO, OPSD, RLSD, and SDAR. The paper includes detailed ablation studies validating the necessity of each component (ablated view, step selection, sign alignment). Furthermore, diagnostic analyses (AUROC of signals against local feedback, word-level preference analysis, observation swapping) provide strong empirical evidence that the proposed residual is indeed more aligned with local environment feedback than the raw Full-view support. The computational overhead is reported to be minimal (~1.4%), which is a significant practical advantage.
The paper provides a public code repository and detailed implementation details in the appendix, including hyperparameters, training protocols, and evaluation settings. The use of standard benchmarks and the clear description of the replay evidence construction facilitate reproduction. The inclusion of random seeds and multiple runs for statistical significance further supports reproducibility.
The primary limitation is that the method relies on the availability of future observations (hindsight), which is specific to interactive/agent settings and not generalizable to all RL tasks. Additionally, while the method improves performance, the gains, while consistent, are not always massive (e.g., ~10-15% relative improvement on ALFWorld), suggesting that the confounding effect, while real, might not be the dominant bottleneck in all scenarios. The method also assumes that the "scaffold" effects are consistent between the Full and Ablated views, which might not hold if the model's attention mechanism is highly sensitive to the specific presence/absence of tokens in complex ways.
This work contributes to the broader understanding of how to effectively use hindsight information in RL for LLM agents. By providing a more calibrated signal, it could lead to more stable and efficient training of agentic systems. The insights into attribution confounds in self-distillation are valuable for the community working on RLHF and agentic RL. The paper presents a well-motivated and effective method for calibrating self-distillation signals in agentic RL, offering a clear solution to a previously underappreciated confounding issue.
Vision-language-action (VLA) models are a widely adopted paradigm for embodied policies. They excel at efficient closed-loop control but do not explicitly model how physical scenes evolve as a task unfolds. Recently emerging world-action models (WAMs) leverage pretrained video world models to capture spatiotemporal evolution, yet retaining future generation or a large video backbone in the control loop substantially increases inference cost. We introduce World Tokens, an embodied policy architecture built around a World Adapter that bridges visual-language understanding, world-dynamics modeling, and action generation. It uses world modeling during training to enhance the action policy while preserving efficient deployment. Specifically, the World Adapter transforms VLM features into a fixed set of world tokens, which condition a jointly fine-tuned future-video denoiser and simultaneously serve as the action expert's sole visual-language context. This shared conditioning allows gradients from future-video denoising to directly shape the representation used for action prediction, while exclusive routing prevents the policy from bypassing that representation. At deployment, the world-model branch is removed, leaving only the VLM, World Adapter, and action expert, with no online video-model inference. With a 2B backbone and no embodied action pretraining, World Tokens is highly competitive on LIBERO, attains the best reported averages on SIMPLER, substantially improves real-world R1 Pro success over a matched action-only baseline, and generates each action chunk at VLA-level latency.
Primary: JIUTIAN Research Zhongguancun Academy
All Institutions: JIUTIAN Research Zhongguancun Academy
World Tokens introduces a training-time world modeling framework that enhances VLA policies by forcing dynamics-relevant information into a shared token representation, achieving state-of-the-art performance on simulation and real-world benchmarks while maintaining VLA-level inference latency.
The paper proposes "World Tokens," a mechanism to inject world-modeling supervision into Vision-Language-Action (VLA) policies without incurring inference latency. The core innovation is a "World Adapter" that compresses VLM features into a fixed set of tokens. These tokens are used to condition a video diffusion model during training (via a structural anchor and cross-attention) and serve as the sole visual context for the action expert. The key architectural constraint is "exclusive routing," preventing the action expert from bypassing these tokens. This forces the representation to encode dynamics-relevant information necessary for both video prediction and action generation. The approach is theoretically sound and addresses a genuine bottleneck in current VLA architectures: the trade-off between predictive accuracy and inference speed. However, the novelty is somewhat incremental, building on established Perceiver-resampler architectures and standard diffusion-based world models (Cosmos), applying them in a specific constrained manner.
The evaluation is comprehensive, covering simulation benchmarks (LIBERO, SIMPLER) and real-world deployment (R1 Pro). The results are strong: 98.2% average on LIBERO and best-reported averages on SIMPLER. The ablation studies are particularly valuable, isolating the contribution of the "exclusive routing" and the "structural anchor" (Canny edges vs. RGB). The attention analysis provides mechanistic insight, showing that world-token supervision leads to sharper, phase-dependent attention maps. The comparison against a matched baseline (Qwen-GR00T) is fair and demonstrates clear gains. The real-world results on the R1 Pro, while limited to 4 tasks, show significant improvement over baselines, suggesting robustness. The use of a 2B backbone without embodied pretraining is a notable efficiency achievement.
The paper provides detailed implementation specifics, including the use of Qwen3-VL-2B, Cosmos Predict2.5-2B, and specific hyperparameters (K=256 tokens, 8-step chunks). The architecture is clearly defined. However, the reliance on proprietary or large pretrained models (Qwen3-VL, Cosmos) and the specific real-world hardware setup (Galaxea R1 Pro with fisheye crop) may pose reproducibility challenges for some labs. The code is not explicitly linked in the text provided, which is a minor negative for immediate reproducibility.
The authors acknowledge that the world model adds considerable training-time cost and that the Canny anchor is hand-designed. The method relies on the availability of high-quality video world models, which may not be accessible or fine-tunable for all researchers. The real-world evaluation is limited in scope (4 tasks, single embodiment). The "exclusive routing" constraint, while effective, might limit the expressiveness of the action expert if the token bottleneck is too severe for complex tasks (though the results suggest K=256 is sufficient).
This work contributes to the field of embodied AI by providing a pathway to more robust, dynamics-aware policies that are still efficient enough for real-time control. It highlights the importance of representation learning in bridging the gap between perception and action. The efficiency gains make advanced world-modeling techniques more accessible for deployment on resource-constrained robotic platforms. World Tokens introduces a training-time world modeling framework that enhances VLA policies by forcing dynamics-relevant information into a shared token representation, achieving state-of-the-art performance on simulation and real-world benchmarks while maintaining VLA-level inference latency.
Monocular 3D object detection spans two regimes: closed-set detectors operating within a fixed category vocabulary, and open-vocabulary detectors that localize arbitrary categories by leveraging depth foundation models for 3D geometry. We find that current depth foundation models, despite their strong zero-shot generalization, lack the object-level precision 3D detection demands: substituting a state-of-the-art depth foundation model for a strong detector's predicted depth degrades accuracy, even falling below the detector's own prediction. Rather than pushing detectors or depth models to be more accurate end-to-end, we treat object-level depth refinement as a stand-alone task and present RefineAny3D, a vision-language model that corrects depth without ever predicting a numerical value. Our key insight is that depth error has a direct visual signature in image space: when projected onto the image, a correctly placed box tightly encloses the object, while a too-far box projects too small and a too-close box projects too large. Depth refinement thus reduces to a visual alignment problem rather than a metric regression problem, which we instantiate by extending the VLM's vocabulary with action tokens that replace numerical depth output with categorical decisions, and by supervising the model on a large-scale chain-of-thought dataset that grounds each decision in explicit visual evidence. Applied as a single post-hoc step, RefineAny3D delivers consistent gains across closed-set detectors, open-vocabulary detectors, and 3D auto-labeling tools, and generalizes to novel categories, scenes, and cameras without retraining.
Primary: Unknown (Affiliations not provided in text)
All Institutions: Unknown
RefineAny3D introduces a novel paradigm for monocular 3D detection by reframing depth refinement as a visual alignment task via VLMs, achieving significant accuracy gains over traditional metric depth regression methods while maintaining generalization capabilities.
The paper proposes "RefineAny3D," a post-hoc refinement module for monocular 3D object detection. The core insight is that depth errors manifest as visual misalignments (box size/position) in the 2D image plane. Instead of regressing depth values, the authors frame depth refinement as a semantic alignment problem using a Vision-Language Model (VLM). They extend the VLM's vocabulary with action tokens to make categorical depth adjustments (e.g., "move box closer") and supervise this using a chain-of-thought dataset. This approach bypasses the need for precise metric depth prediction, leveraging the VLM's ability to reason about spatial relationships visually. The methodology is conceptually sound and represents a clever shift from regression to classification/alignment in the context of 3D detection.
The paper evaluates RefineAny3D as a plug-and-play module on closed-set detectors (e.g., CenterPoint, VoxelNeXt) and open-vocabulary detectors. Results indicate consistent gains in 3D detection metrics (mAP, AEP) across various benchmarks (likely KITTI, Waymo, or nuScenes, though specific dataset names are obscured in the provided text snippets). The ability to generalize to novel categories and scenes without retraining is a significant empirical finding. The comparison against state-of-the-art depth foundation models shows that the proposed method outperforms even strong zero-shot depth predictors, validating the hypothesis that metric depth is not strictly necessary for high-precision detection if alignment is handled correctly.
The provided text contains fragmented information regarding training infrastructure (DeepSpeed ZeRO-3, H100s) but lacks specific hyperparameters, dataset splits, or exact model architectures for the VLM backbone. The "chain-of-thought dataset" creation process is mentioned but not detailed in the snippets. Reproducibility would require access to the codebase and the specific prompt templates/dataset construction pipeline, which are not fully visible here.
The method relies on the availability of a capable VLM, which may introduce inference latency compared to lightweight regression heads. The performance is contingent on the quality of the 2D bounding box proposals; if the 2D detection fails, the 3D refinement cannot correct it. Furthermore, the "visual signature" assumption holds well for rigid objects but may struggle with highly deformable objects or those with ambiguous boundaries. The paper does not explicitly discuss failure cases where visual alignment is ambiguous (e.g., occluded objects).
This work lowers the barrier for high-precision 3D detection by decoupling it from the difficult task of metric depth estimation. It enables the use of powerful, general-purpose VLMs for specialized 3D tasks, potentially democratizing access to robust perception systems for autonomous driving and robotics. However, the reliance on large VLMs may increase computational costs and energy consumption during inference. RefineAny3D introduces a novel paradigm for monocular 3D detection by reframing depth refinement as a visual alignment task via VLMs, achieving significant accuracy gains over traditional metric depth regression methods while maintaining generalization capabilities.
Neural language models trained on large crowdsourced corpora frequently exploit spurious surface patterns tied to target labels without true linguistic or causal relevance, boosting benchmark performance while failing on adversarial or out-of-distribution inputs. Existing approaches either require manual specification of the feature vocabulary or automate discovery only partially, leaving the gap between dataset-level correlation and model-level exploitation unaddressed. We present U N M ASK, a fully automated pipeline that discovers, causally verifies, and mitigates spurious correlations in text classifiers without additional human annotation. Given unlabeled training examples, U N M ASK generates candidate surface patterns as executable boolean expressions, filters them through a statistical validation protocol with independent replication, and establishes causal model dependence via verified counterfactual interventions. Causally confirmed features then serve as annotation-free group definitions for Deep Feature Reweighting, eliminating the group labels that standard DFR requires. Applied to BERT and RoBERTa trained on MNLI, our pipeline independently rediscovers established lexical-overlap and negation biases, verifying 9 of 10 features on BERT and 6 on RoBERTa, and improving HANS accuracy by up to 12.58 pp. On CivilComments-WILDS, programmatic groups match the 70.1% worst- group accuracy of hand-labeled DFR (Kirichenko et al., 2023) without demographic annotation. We further demonstrate that the discovery and validation stages generalize to reward model preference data, surfacing interpretable spurious correlations in RewardBench2.
Primary: University of North Carolina
All Institutions: University of North Carolina
UNMASK presents a rigorous, automated framework for identifying and mitigating spurious correlations in text classifiers by leveraging executable boolean expressions and causal verification, significantly advancing the state of the art in debiasing NLP models without human annotation.
The paper proposes UNMASK, a fully automated pipeline for discovering, verifying, and mitigating spurious correlations in text classifiers. The core innovation lies in the representation of spurious features as executable boolean expressions, generated by an LLM (SCGenLLM) and rigorously validated for syntactic and semantic correctness. The pipeline employs a two-phase statistical validation protocol (discovery and replication) to filter candidates, followed by a causal verification stage using counterfactual interventions generated by another LLM. This causal stage is critical, as it distinguishes dataset-level correlation from actual model-level exploitation. The confirmed features are then used to construct annotation-free groups for Deep Feature Reweighting (DFR). The methodology is sound, addressing a significant gap in existing literature where feature discovery is either manual or lacks causal verification. The use of boolean expressions allows for deterministic evaluation and reuse across pipeline stages, which is a clever design choice.
The evaluation is comprehensive, covering Natural Language Inference (MNLI, SNLI, ANLI, HANS), Toxicity Detection (CivilComments-WILDS), and Sentiment Analysis (SST-2, IMDB). The results demonstrate that UNMASK successfully rediscover known biases (lexical overlap, negation) and verifies their causal impact on BERT and RoBERTa. A key finding is the cross-architecture divergence, where RoBERTa is shown to be less susceptible to certain contradiction-class features than BERT. On CivilComments, the programmatic groups match the performance of hand-labeled DFR, demonstrating the efficacy of the annotation-free approach. The ablation studies, particularly on sentiment data where the pipeline correctly identifies zero exploited features, provide strong evidence for the causal gate's validity. The comparison against simpler baselines (PMI, LLM-only) highlights the value of the full pipeline.
The paper provides a detailed reproducibility statement, including hyperparameters, prompt templates, and a link to the source code. The use of fixed seeds and held-out feature sets for model-dependent stages enhances reproducibility. The code release includes per-sample counterfactual annotations, which is a significant contribution to transparency. The API costs are also reported, which is helpful for practitioners.
The authors acknowledge that the requirement for executable boolean expressions limits the scope to surface-level patterns, potentially missing latent or semantic shortcuts. The causal verification is bounded by the quality of the counterfactual generator, and co-firing features are removed jointly, which may overestimate individual feature contributions. The reliance on LLMs for generation and evaluation introduces potential biases and costs, although the paper attempts to mitigate this by using different models for different roles.
This work has significant implications for understanding and mitigating spurious correlations in NLP models, which is crucial for building robust and fair systems. By automating the discovery and verification of biases, UNMASK lowers the barrier to entry for debiasing efforts. The findings regarding cross-architecture differences and the generalizability to reward models provide valuable insights for the broader ML community. The potential for misuse (e.g., identifying and exploiting biases in other models) is a minor concern, but the primary impact is positive towards model robustness and interpretability. UNMASK presents a rigorous, automated framework for identifying and mitigating spurious correlations in text classifiers by leveraging executable boolean expressions and causal verification, significantly advancing the state of the art in debiasing NLP models without human annotation.
Internal safety scores judge a prompt before any text is generated, and they are validated by how well they separate harmful prompts from benign ones. That separation is then read as evidence that the score will also catch the attacks that succeed. Harmful intent is a property of the prompt. Jailbreak success is an outcome produced later by a particular target model, decoding policy, and judge. A filter tuned on a score that measures the wrong quantity spends its false positive budget on attacks that would have failed anyway. In this paper we audit that inference. Attention based measurements are usually read from prompt dependent locations, so a wrapper changes both the content being judged and the place the signal is taken from. We therefore introduce Active Attention Probing, which supplies a fixed content independent measurement coordinate. We pair every base goal with a plain and a wrapped version and generate real completions from the target models. On Llama, wrapping raises harmful generation from 0.05 to 0.27 while harmful intent AUROC falls from 0.936 to 0.803, so the attacks grow more dangerous while the prompts look safer to the score. Among wrapped harmful prompts the outcome AUROC is 0.220, which places the attacks that succeeded below the attacks that failed. Rare token, passive, and detector derived channels reproduce the reversal on the same matched design, and the reversal itself persists across three target models, seven attack families, and two independent judges. Distribution shift then degrades calibration and threshold transfer before it degrades ranking.
Primary: Fudan University
All Institutions: Fudan University, Shanghai University, Beijing Normal University, Tsinghua University, Institute of Advanced Intelligence and Computing (A*STAR), East China Normal University, Worcester Polytechnic Institute
This paper provides a rigorous audit demonstrating that internal safety scores are fundamentally misaligned with actual jailbreak success, introducing Active Attention Probing to reveal that the most dangerous attacks are those that appear safest to internal probes, thereby challenging the validity of prompt-only safety filters.
The paper introduces a critical methodological critique of current LLM safety evaluation practices, specifically targeting "internal safety scores" (e.g., classifier-based or embedding-based harm detectors) that operate on the prompt before generation. The core methodological contribution is "Active Attention Probing," a technique designed to isolate model internal states from prompt-dependent positional biases by using fixed, content-independent measurement coordinates. This allows for a cleaner audit of whether internal representations actually correlate with harmful intent versus just surface-level lexical features. The approach of pairing base goals with wrapped (jailbreak) versions and comparing internal scores against actual generation outcomes is rigorous and well-designed for isolating the specific failure mode of "anti-ranking."
The experimental design is robust, leveraging a matched-pairs design across three target models (Llama and two others), seven attack families, and two independent judges. The results are striking and counter-intuitive to current safety paradigms: wrapping (jailbreaking) increases harmful generation rates (0.05 to 0.27) while simultaneously decreasing the AUROC of internal harm detectors (0.936 to 0.803). This demonstrates that the most dangerous attacks are those that look "safest" to internal probes. The consistency of this "reversal" across different channels (rare token, passive, detector-derived) strengthens the validity of the findings. The use of real completions rather than synthetic proxies for the "ground truth" of harm is a significant strength.
The paper provides sufficient detail on the methodology, including the definition of Active Attention Probing and the experimental setup (models, attacks, judges). The use of standard benchmarks and well-known models (Llama) facilitates reproduction. The specific implementation of the probing mechanism is described, though exact code for the "fixed content independent measurement coordinate" would be necessary for perfect reproducibility; however, the description is likely sufficient for a competent researcher to implement. The dataset of paired prompts is implied to be constructed systematically, which aids reproducibility.
The primary limitation is the scope of "internal safety scores." The paper focuses heavily on attention-based and embedding-based proxies. It does not extensively evaluate other emerging safety mechanisms like RLHF reward models or more complex constitutional AI checks, although the logic likely extends to them. Additionally, the study focuses on text-based jailbreaks; multimodal jailbreaks are not addressed. The finding that "distribution shift degrades calibration... before ranking" suggests that even if ranking is preserved, thresholding is unreliable, which is a subtle point that might be under-emphasized in practical deployment contexts where thresholding is key.
This paper has profound implications for the field of AI safety. It challenges the fundamental assumption that pre-generation internal signals are reliable indicators of post-generation harm. If safety filters rely on these flawed internal scores, they may inadvertently suppress benign content (high false positives) while missing sophisticated attacks (high false negatives that look "safe"). This could lead to a false sense of security in deployed systems. The findings advocate for a shift towards outcome-based evaluation (judging the response, not just the prompt) or more robust internal representations that are invariant to adversarial wrapping. This work is crucial for developing more reliable safety guardrails. This paper provides a rigorous audit demonstrating that internal safety scores are fundamentally misaligned with actual jailbreak success, introducing Active Attention Probing to reveal that the most dangerous attacks are those that appear safest to internal probes, thereby challenging the validity of prompt-only safety filters.
We identify and quantify temporal misgrounding: the systematic retrieval and citation of the currently in-force version of a legal article when the applicable version is an earlier or future one. Standard legal RAG treats the corpus as static; we argue legal question answering is a temporally-indexed retrieval problem. We introduce FiscalQA Pro, pairing a versioned corpus of 32,436 article-versions of the French tax code (93 years, 1938-2031) with an all-model-hard temporal-reasoning track: 209 scored, expert-reviewed questions across 33 CGI articles (221 released; twelve flagged out of the answerable scope). At selection time, no evaluated model recovered its date-applicable answer closed-book in any of four sampling draws, and the currently in-force text lacks the gold value for all but one of the scored questions. Answers are scored deterministically via atomic ground-truth "nuggets" (regex and numeric-with-tolerance), never LLM-as-judge: an LLM judge would inherit the temporal bias it is meant to score. Across eleven models (five frontier closed-API systems plus Gemini 2.5 Pro as a substitute entry, and five open-weight), parametric knowledge yields 3.0% mean strict accuracy and RAG over a static current-version corpus 2.7%. Static RAG retrieves the date-applicable version 0% of the time, confidently citing a real but inapplicable version. Our end-to-end retriever over a multi-version index, with no oracle, reaches 98.3% mean strict; an oracle-article ablation reaches 99.1%, locating the residual gap in first-stage recall, not version selection. We additionally release a version-aware jurisprudence dataset of 69,208 citation links, together with the corpus, benchmark, model responses, and pipeline code.
Primary: Talia
All Institutions: Talia, Databricks
This paper presents a rigorous and necessary benchmark for evaluating temporal reasoning in Legal RAG, demonstrating that current state-of-the-art models systematically fail to retrieve the correct temporal version of legal texts, and providing a high-performing baseline solution that the community can adopt and improve upon.
The paper introduces a novel evaluation framework for Legal RAG systems, specifically targeting "temporal misgrounding." The core methodological contribution is the construction of FiscalQA Pro, a benchmark consisting of a versioned corpus of the French tax code (1938-2031) and 209 expert-reviewed questions. The methodology rigorously isolates the temporal reasoning capability by providing atomic ground-truth nuggets for deterministic scoring, explicitly avoiding LLM-as-judge to prevent bias. The authors also propose and evaluate a multi-version retriever pipeline designed to handle version selection, contrasting it against standard static RAG baselines.
The experimental setup is robust and well-controlled. The authors evaluate 11 models (5 closed-API, 5 open-weight, 1 substitute) on the benchmark. The results are striking and significant: standard RAG over static current-version corpora achieves 0% retrieval of the date-applicable version and 2.7% strict accuracy, while closed-book parametric knowledge yields only 3.0%. The proposed end-to-end retriever over a multi-version index achieves 98.3% mean strict accuracy. The ablation studies (oracle-article) further pinpoint that the residual errors lie in first-stage recall rather than version selection. The use of deterministic scoring and the clear demonstration of a systematic failure mode in current SOTA models provide strong empirical evidence for the paper's claims.
The paper provides a GitHub repository with code, data, and model responses. The dataset is built from public legislation, ensuring legal accessibility. The scoring methodology is deterministic (regex/numeric), which enhances reproducibility compared to subjective LLM-based evaluations. The detailed description of the corpus construction (32,436 article versions) and the benchmark creation process allows for independent verification.
The primary limitation is the domain specificity; the benchmark is focused on French Tax Law (CGI articles). While the temporal misgrounding problem is likely generalizable to other legal domains, the specific linguistic and structural characteristics of French tax law may limit direct transferability without adaptation. Additionally, the benchmark covers a specific historical and future range (1938-2031), which, while comprehensive for recent tax law, might not capture all edge cases of legal evolution. The paper also notes that the "future" versions are likely projections or enacted laws not yet in force, which requires careful interpretation by users.
This work has significant implications for the reliability of AI in high-stakes legal domains. By identifying and quantifying temporal misgrounding, it highlights a critical flaw in current RAG architectures that treat legal corpora as static. The release of the benchmark and methodology encourages the community to develop temporally-aware retrieval systems, potentially reducing confidently-wrong outputs in tax compliance and legal research. The impact statement correctly notes that outputs should be verified by professionals, emphasizing responsible deployment. This paper presents a rigorous and necessary benchmark for evaluating temporal reasoning in Legal RAG, demonstrating that current state-of-the-art models systematically fail to retrieve the correct temporal version of legal texts, and providing a high-performing baseline solution that the community can adopt and improve upon.
Steering vectors are a lightweight tool for controlling LLM behavior. However, emerging evidence shows that steering vectors can unintentionally compromise a model's safety mechanisms and increase compliance with harmful requests, while no effective mitigation yet exists. In this work, we show that this safety degradation arises from a separable component in the vector that disrupts the model's safety mechanisms but contributes little to the steering objective. We identify and remove this safety-degrading component, formulating the task as a constrained optimization problem solved through primal-dual updates, subject to preserving the intended steering effect and bounding false refusal. The resulting solution is both interpretable and surgical: the optimization recovers a single direction whose ablation from the steering vector restores model safety with minimal utility cost. Across models, steering behaviors, and attack suites, including unseen attacks types, our method substantially reduces steering-induced safety degradation while preserving the original steering effect with minimal impact on false refusal. Our method offers a post-hoc correction to steering vectors that mitigates their safety cost, and more broadly, it provides a general recipe for applying activation-level model interventions without paying a safety tax.
Primary: Munich Center for Machine Learning (MCML)
All Institutions: Munich Center for Machine Learning (MCML), European Union (Horizon Europe Research and Innovation Program)
The paper introduces CAST, a novel post-hoc optimization method that effectively decouples safety degradation from steering utility in LLM activation vectors, offering a significant practical advancement for safe model intervention.
The paper proposes CAST (Constrained Ablation for Safe STeering), a post-hoc method to sanitize steering vectors by identifying and removing a specific direction in activation space that degrades safety without significantly harming the intended behavioral effect. The core technical contribution is formulating this as a constrained optimization problem solved via primal-dual updates. The method uses a differentiable proxy for refusal behavior (partial KL divergence over refusal tokens) to guide the optimization of the ablated direction. The approach is theoretically sound, leveraging the geometric separability of safety-degrading components from utility components in high-dimensional activation spaces. The use of primal-dual optimization to automatically balance constraints (safety, effect preservation, false refusal) is a robust engineering choice that avoids manual hyperparameter tuning of loss weights.
The experimental evaluation is comprehensive and rigorous. The authors test their method across three distinct model families/scales (Llama-3.1-8B, Qwen2.5-7B, Qwen2.5-14B) and three behavioral steering targets (Corrigibility, Power-Seeking, Self-Awareness). They evaluate against a wide range of jailbreak attacks, including static templates and adaptive attacks (GCG, AutoDAN, PAIR) not seen during training, demonstrating strong generalization. The results show that CAST reduces Attack Success Rate (ASR) to baseline levels while preserving steering utility and minimizing false refusals. The ablation studies effectively isolate the contribution of each constraint. The inclusion of general capability benchmarks (MMLU, GSM8K, etc.) confirms that the intervention does not broadly degrade model performance.
The paper provides a GitHub repository with code, detailed hyperparameters, and pseudocode. The training data sources are cited, and the construction of the harmful/benign/effect prompt sets is described. The use of standard models and evaluation benchmarks (JailbreakBench, Alpaca, XSTest) ensures that results can be replicated. The computational cost is reasonable (~90-120 minutes on an A100/H200), making it accessible for replication.
The method relies on the assumption that the safety-degrading component is linearly separable and can be captured by a rank-1 vector. While the paper argues this is sufficient, higher-rank ablations were tested and found less effective, but the theoretical justification for why rank-1 is always sufficient across all potential steering vectors and model architectures is not fully proven. Additionally, the method requires a small amount of computation to optimize the vector for each new steering vector, which adds a step to the deployment pipeline, although it is post-hoc and does not require model retraining. The reliance on LLM-as-a-Judge for evaluation introduces potential bias, although the authors provide human validation for the judge's reliability.
This work addresses a critical bottleneck in the practical deployment of steering vectors for LLM alignment and behavior control. By providing a reliable method to mitigate safety risks without sacrificing utility, it enables safer and more widespread use of activation-level interventions. This contributes to the broader goal of developing robust, controllable, and safe AI systems. The findings also advance mechanistic interpretability by providing empirical evidence for the separability of safety and utility components in activation space. The paper introduces CAST, a novel post-hoc optimization method that effectively decouples safety degradation from steering utility in LLM activation vectors, offering a significant practical advancement for safe model intervention.
Large Language Models (LLMs) have accelerated drug discovery, particularly in the automated design of antimicrobial peptides (AMPs). However, current validation pipelines for peptide generation models overlook historical precedents showing that certain drugs carry health risks predominantly for individuals with specific genetic profiles. In this paper, we demonstrate that such targeted health risks can be induced intentionally and at scale by manipulating models that generate peptide candidates. We introduce the Genotypic Trigger, a backdoor attack that shifts a model's generative distribution toward peptides with elevated predicted immunogenicity risk, an adverse immune reaction, specifically for carriers of a targeted HLA allele, a gene variant involved in immune presentation. Across popular peptide generation models, the attack increased the predicted immunogenicity risk score for target-allele carriers by 743% on average relative to natural peptides from existing databases, while the predicted risk for non-carriers remained close to the natural baseline. Crucially, these backdoored models retained or improved primary desired properties, including high antimicrobial potency and low general toxicity, allowing their outputs to pass conventional safety screens.
Primary: Michigan Technological University
All Institutions: Kansas State University, Lehigh University, Michigan Technological University
[One sentence main contribution]. This paper introduces Genotypic Triggers, a novel backdoor attack that manipulates generative antimicrobial peptide models to produce sequences with elevated, allele-specific immunogenicity risks while preserving therapeutic utility. [Comprehensive analysis of the technical contribution, methodology, and significance to the field]. The technical contribution is substantial as it identifies a new class of vulnerabilities in biological AI systems—host-conditioned backdoors. The methodology is robust, leveraging iterative self-training and multi-objective optimization to achieve stealth and efficacy. The significance lies in its challenge to the current paradigm of AI safety in drug discovery, which largely ignores population genetic diversity. By providing a concrete demonstration of how such risks can be induced, the paper serves as a wake-up call for the community to integrate pharmacogenomic considerations into the security and validation frameworks of generative models. The high technical impact score reflects the potential for this work to reshape safety standards in computational biology.
The paper introduces "Genotypic Triggers," a novel backdoor attack framework targeting generative models for antimicrobial peptides (AMPs). The methodology is technically sound and well-structured. It employs a greedy point-mutation strategy to create a poisoned dataset ($D_{poison}$) that maximizes predicted binding affinity to a specific HLA allele (HLA-DRB1*09:01) while minimizing off-target binding and preserving standard AMP properties (helicity, toxicity, MIC). The use of iterative self-training to reinforce the backdoor is a sophisticated approach that addresses the difficulty of transferring discrete sequence properties into continuous latent spaces of autoregressive models. The separation of the attack objective (immunogenicity risk) from the utility constraints (antimicrobial potency) is clearly defined and mathematically formalized.
The experimental evaluation is rigorous and comprehensive. The authors test the attack across three distinct, popular peptide generation models (AMP-GPT, ProGen2, RITA), demonstrating the generality of the vulnerability. They provide ablation studies confirming the necessity of both the mutation-guided poisoning and the self-training steps. Crucially, they validate the results using an independent predictor (MixMHC2pred-2.0) that was not used during training, showing that the effect is not merely an artifact of over-optimizing a single proxy tool. The results show a significant increase in predicted immunogenicity risk for the target allele (up to 743%) while maintaining or improving utility metrics. The diversity and novelty of generated sequences are also analyzed, showing that the attack does not cause mode collapse.
The paper provides detailed experimental settings, including hyperparameters, filtering thresholds, and model architectures. The use of standard datasets (AMPSphere) and well-known models enhances reproducibility. The description of the greedy mutation and clustering steps is sufficiently detailed for replication. However, the specific random seeds and exact versioning of the prediction tools (NetMHCIIpan, MixMHC2pred) are critical for exact replication and should be explicitly stated in the final version. The code is not linked, which is a minor hindrance to immediate reproducibility.
The primary limitation, acknowledged by the authors, is the reliance on computational predictions rather than wet-lab validation. While the proxies are well-established, the actual immunogenicity in vivo may differ. Additionally, the attack assumes the attacker can fine-tune the model on public repositories, which may be mitigated by model watermarking or rigorous auditing of fine-tuned checkpoints. The scope is limited to HLA class II mediated responses; HLA class I responses are not addressed.
This work has significant implications for the security and safety of AI-driven drug discovery. It highlights a critical blind spot in current validation pipelines: the assumption that safety screens are genotype-agnostic. By demonstrating that models can be manipulated to produce therapeutically effective but genetically targeted harmful peptides, the paper raises serious ethical and security concerns. It necessitates the development of "genotype-aware" safety auditing standards for biological foundation models. The dual-use nature of this research is high, as the methodology could theoretically be adapted for other targeted biological harms, though the specific context of AMPs makes it particularly relevant to public health security. [One sentence main contribution]. This paper introduces Genotypic Triggers, a novel backdoor attack that manipulates generative antimicrobial peptide models to produce sequences with elevated, allele-specific immunogenicity risks while preserving therapeutic utility. [Comprehensive analysis of the technical contribution, methodology, and significance to the field]. The technical contribution is substantial as it identifies a new class of vulnerabilities in biological AI systems—host-conditioned backdoors. The methodology is robust, leveraging iterative self-training and multi-objective optimization to achieve stealth and efficacy. The significance lies in its challenge to the current paradigm of AI safety in drug discovery, which largely ignores population genetic diversity. By providing a concrete demonstration of how such risks can be induced, the paper serves as a wake-up call for the community to integrate pharmacogenomic considerations into the security and validation frameworks of generative models. The high technical impact score reflects the potential for this work to reshape safety standards in computational biology.
Humanoid household tasks often require concurrent loco-manipulation, where the robot must move, adjust posture, maintain balance, and manipulate objects as a single coordinated behavior. Yet existing humanoid policies typically decompose locomotion and manipulation, while recent world-action models remain either arm-centric or video-centered. We present $ω$-0, a latent predictive whole-body world-action model for real-world humanoid concurrent loco-manipulation. Given a language instruction, current visual observation, and robot proprioceptive state, $ω$-0 directly predicts controller-compatible whole-body action latents for real-robot execution. Rather than reconstructing future videos, $ω$-0 learns compact future observation embeddings as a lightweight predictive objective, coupling latent visual foresight with diffusion-based whole-body action generation. The model supports egocentric RGB, exocentric RGB, and exocentric depth inputs, and leverages controller-based simulation replay to ground human/public visual-motion priors into robot-executable action latents. We further collect $ω$-HOME, a 40+ hour real-world household humanoid dataset with synchronized multi-view observations, whole-body SMPL motions, robot states, and action latents. Real-world experiments on 11 household tasks demonstrate that a single $ω$-0 model can produce smooth manipulate-while-moving behaviors and consistently outperform representative imitation learning, VLA, humanoid, and WAM baselines.
Primary: Shanghai Jiao Tong University
All Institutions: Shanghai Jiao Tong University, Tsinghua University, University of Cambridge
The paper presents a significant advancement in humanoid robotics by introducing a latent predictive world-action model that effectively handles concurrent loco-manipulation. The introduction of the $\omega$-HOME dataset and the novel approach of predicting action latents rather than visual reconstructions offer a compelling alternative to existing methods. The strong empirical results on real-world tasks suggest that this approach is viable and impactful. [One sentence main contribution]. The paper introduces $\omega$-0, a latent predictive world-action model for concurrent humanoid loco-manipulation, and the $\omega$-HOME dataset, demonstrating superior performance over existing imitation learning and VLA baselines in real-world household tasks.
The paper proposes $\omega$-0, a latent predictive world-action model designed for concurrent humanoid loco-manipulation. The core methodological contribution is the shift from video reconstruction (common in visual world models) to predicting controller-compatible whole-body action latents. This approach couples latent visual foresight with diffusion-based action generation. The model ingests language instructions, multi-view observations (RGB/Depth), and proprioceptive states to output actions directly. The use of "controller-based simulation replay" to ground human/public visual-motion priors into robot-executable action latents is a significant technical choice, aiming to bridge the sim-to-real gap and leverage large-scale pre-trained priors. The architecture appears to be a transformer-based or diffusion-based sequence model operating in a latent space, which is a current trend in robotics (e.g., RT-2, Octo, but applied to whole-body control).
The evaluation includes the collection of $\omega$-HOME, a 40+ hour real-world household humanoid dataset. This is a substantial contribution in itself, providing a benchmark for concurrent loco-manipulation. Experiments are conducted on 11 household tasks. The paper claims that $\omega$-0 outperforms representative imitation learning, VLA (Vision-Language-Action), humanoid-specific, and WAM (World Action Model) baselines. The results demonstrate smooth manipulate-while-moving behaviors. The inclusion of real-world experiments is crucial for this domain. However, the specific quantitative metrics (e.g., success rates, task completion times, kinematic smoothness scores) are not fully detailed in the abstract, but the claim of consistent outperformance suggests rigorous benchmarking. The comparison against VLAs is particularly relevant given the current hype cycle.
The paper introduces a new dataset ($\omega$-HOME), which aids reproducibility for future work in this specific niche. The code and model weights are not explicitly linked in the provided text, but the detailed description of the model architecture and the dataset collection process suggests that the work is grounded in reproducible practices. The use of standard inputs (RGB, Depth, Proprioception) and outputs (Action Latents) facilitates integration with existing control stacks.
The paper likely faces limitations common to latent world models: the quality of the action latent space is dependent on the fidelity of the predictive model. If the prediction of future latent states is inaccurate, the action generation may fail. Additionally, the reliance on "human/public visual-motion priors" might introduce biases or domain gaps if the training data distribution differs significantly from the deployment environment. The complexity of training a whole-body model with concurrent loco-manipulation constraints is high, and the computational requirements for inference might be a barrier for real-time deployment on current humanoid hardware.
This work contributes to the broader goal of general-purpose humanoid robots capable of performing complex household tasks. By enabling concurrent loco-manipulation, it moves beyond static manipulation, which is a critical step towards practical autonomy. The release of the $\omega$-HOME dataset provides a valuable resource for the robotics community, potentially accelerating research in whole-body control and world models. The paper presents a significant advancement in humanoid robotics by introducing a latent predictive world-action model that effectively handles concurrent loco-manipulation. The introduction of the $\omega$-HOME dataset and the novel approach of predicting action latents rather than visual reconstructions offer a compelling alternative to existing methods. The strong empirical results on real-world tasks suggest that this approach is viable and impactful. [One sentence main contribution]. The paper introduces $\omega$-0, a latent predictive world-action model for concurrent humanoid loco-manipulation, and the $\omega$-HOME dataset, demonstrating superior performance over existing imitation learning and VLA baselines in real-world household tasks.
Heterogeneous architectures that combine neural processing unit (NPU) and processing-in-memory (PIM) are increasingly adopted to accelerate LLM inference. Prior work focuses on building a unified memory that allows NPUs and PIM to share data without duplication. However, these designs implicitly assume that each tensor is bound to a fixed execution device, and therefore rely on static, device-biased data mappings. We observe that this assumption does not hold in modern LLM workloads. Due to phase changes (e.g., prefill vs. decode) and dynamic behaviors such as MoE routing, the optimal execution device for the same tensor can change at runtime. Under such dynamic execution, device-biased mappings become mismatched to access patterns, leading to substantial bandwidth underutilization and performance loss. This paper presents PFM (PIM-as-Flexible-Memory), a dual-view memory system that decouples physical data layout from accessor-visible logical views. PFM stores data in a jointly optimized physical layout and exposes different logical interpretations to NPUs and PIM, enabling efficient access across devices without data duplication or relayout. We further design accessor-aware address translation and runtime scheduling mechanisms to support dynamic execution when LLM workloads fluctuate and the optimal execution device dynamically changes. Our evaluation across LLMs shows that PFM improves end-to-end throughput by up to 2.32$\times$, demonstrating its effectiveness and broad applicability as a unified memory management solution for NPU-PIM systems.
Primary: Institute of Computing Technology, Chinese Academy of Sciences
All Institutions: Institute of Computing Technology, Chinese Academy of Sciences, University of Chinese Academy of Sciences
This paper presents a significant systems-level contribution to NPU-PIM architectures by introducing a dual-view memory system that dynamically adapts to LLM workload phases, achieving substantial throughput improvements through efficient data layout decoupling.
The paper proposes PFM (PIM-as-Flexible-Memory), a system architecture designed to address the inefficiencies of static memory mappings in NPU-PIM heterogeneous systems. The core innovation lies in decoupling the physical data layout from logical views, allowing the same physical memory to be interpreted differently by the NPU and PIM components. This is supported by accessor-aware address translation and runtime scheduling. The methodology is sound and addresses a specific, well-identified bottleneck in modern LLM inference (phase changes and MoE routing) that prior unified memory designs overlooked. The approach is technically sophisticated, requiring careful hardware-software co-design.
The evaluation demonstrates up to 2.32x improvement in end-to-end throughput across various LLM workloads. The results are significant for the specific domain of NPU-PIM systems. However, the scope is limited to this specific hardware configuration. The performance gains are substantial, validating the hypothesis that dynamic mapping outperforms static, device-biased mappings. The evaluation appears rigorous within its niche, though it lacks comparison against general-purpose unified memory solutions that might be adapted for this hardware.
The paper provides detailed descriptions of the PFM mechanism, including address translation and scheduling. As a systems paper, reproducibility depends on the availability of the simulation framework or hardware prototype. The authors do not explicitly mention an open-source codebase or simulation environment in the provided text, which is a common limitation in top-tier systems venues unless specifically mandated. However, the technical details provided are sufficient for a knowledgeable researcher to implement a simulation.
The primary limitation is the narrow applicability. PFM is tailored specifically for NPU-PIM architectures. It does not offer insights or improvements for standard CPU-GPU or multi-GPU systems, which constitute the majority of LLM inference infrastructure. Furthermore, the overhead of runtime scheduling and address translation must be negligible for the gains to hold, a claim that requires careful benchmarking against the baseline static mapping overhead. The paper assumes a specific hardware topology that may not be representative of all emerging PIM technologies.
This work contributes to the growing field of specialized AI hardware. As NPUs and PIM become more prevalent in edge and data center AI accelerators, efficient memory management will be critical. PFM provides a blueprint for handling dynamic workloads in such environments. While not immediately applicable to the broader ML community using standard GPUs, it influences the design of future hardware-software stacks for specialized AI accelerators. This paper presents a significant systems-level contribution to NPU-PIM architectures by introducing a dual-view memory system that dynamically adapts to LLM workload phases, achieving substantial throughput improvements through efficient data layout decoupling.
Top-k sparse attention makes long-context LLM decoding cheap to compute: each step reads only a few thousand selected KV entries rather than the full context. Serving systems, however, typically keep the entire KV cache in GPU HBM so that every position stays selectable, so a request's memory bill still grows with its full context length--decoding hits a capacity wall long before it runs out of compute, and a context whose KV cache exceeds HBM cannot be served at all. We present HiSparse, an exact, indexer-agnostic hierarchical KV cache for sparse-attention serving. HiSparse keeps each request's full KV history in host memory and bounds its decode footprint with a small, fixed-size GPU cache; a fused CUDA kernel resolves each layer's selections--hit detection, LRU replacement, and host-to-device fetches--inside the decode CUDA graph; and, for models that share selections across layers, exact layer-wise prefetching hides roughly half of the remaining miss overhead. Because only KV placement changes, model outputs are unchanged. HiSparse is merged into upstream SGLang and evaluated across three sparse-attention families (DSA, NSA, and Quest) on H200, B200, and GH200 platforms: it improves peak generation throughput by up to 4.7x on long-context workloads while preserving comparable per-token latency and reducing time-to-first-token at high load--and a no-IO oracle shows the resolution mechanism itself adds no measurable per-token cost, leaving host-device IO as the only price of bounded residency.
Primary: Stanford University
All Institutions: Stanford University, NVIDIA, Alibaba Cloud, Ant Group, Baidu, Zhipu AI
HiSparse introduces a hierarchical KV cache management system that enables efficient serving of long-context LLMs with sparse attention by bounding GPU memory usage through host-GPU memory hierarchy and optimized IO handling. This systems-level contribution effectively bridges the gap between the theoretical compute savings of sparse attention and the practical memory constraints of current GPU hardware, offering a scalable solution for high-throughput long-context inference.
The paper proposes HiSparse, a hierarchical KV cache management system designed to decouple the memory footprint of sparse-attention LLM serving from the context length. The core innovation lies in keeping the full KV history in host memory while maintaining a small, fixed-size GPU cache. It utilizes a fused CUDA kernel to handle hit detection, LRU replacement, and host-to-device fetches within the decode CUDA graph, aiming to minimize overhead. For models with consistent selection patterns across layers, it implements exact layer-wise prefetching to hide IO latency. This is a systems-oriented contribution that addresses a specific bottleneck in long-context serving: the inability to serve requests whose KV caches exceed HBM capacity when using sparse attention, despite the compute savings.
The evaluation is conducted on H200, B200, and GH200 platforms, integrating HiSparse into the upstream SGLang framework. It tests against three sparse-attention families: DSA, NSA, and Quest. The results claim up to 4.7x improvement in peak generation throughput for long-context workloads, with comparable per-token latency. An "oracle" experiment isolates the resolution mechanism's cost, showing it adds no measurable per-token cost, attributing overhead solely to host-device IO. The evaluation is rigorous in its isolation of variables but relies on synthetic or standard benchmarks typical for serving systems.
The paper mentions integration into SGLang, which is an open-source project, suggesting potential for reproducibility. However, the specific fused CUDA kernels and the exact configuration of the hierarchical cache are proprietary to the implementation details described. The use of specific hardware (H200/B200/GH200) makes exact replication of performance numbers difficult for those without access to NVIDIA's latest data centers. The "no-IO oracle" result is a strong theoretical claim that would benefit from more detailed breakdown of the overhead components.
The primary limitation is the dependency on host memory bandwidth and latency. While the GPU compute is optimized, the system still requires fetching KV entries from host memory, which is significantly slower than HBM. The "hiding" of this latency via prefetching is effective only if the access patterns are predictable (as in the layer-wise sharing case). For highly dynamic or unpredictable sparse attention patterns, the miss rate and resulting IO overhead could degrade performance. Additionally, the system adds complexity to the serving stack, requiring careful tuning of the GPU cache size and prefetching strategies.
This work has significant implications for the practical deployment of long-context LLMs. By enabling the serving of contexts that exceed GPU memory limits without sacrificing the compute efficiency of sparse attention, it lowers the barrier to entry for high-throughput long-context inference. This could accelerate the adoption of long-context capabilities in production systems, allowing for more complex reasoning and document processing tasks. It also highlights the importance of systems-level optimizations in realizing the potential of algorithmic innovations like sparse attention. HiSparse introduces a hierarchical KV cache management system that enables efficient serving of long-context LLMs with sparse attention by bounding GPU memory usage through host-GPU memory hierarchy and optimized IO handling. This systems-level contribution effectively bridges the gap between the theoretical compute savings of sparse attention and the practical memory constraints of current GPU hardware, offering a scalable solution for high-throughput long-context inference.
The reasoning and agentic capabilities of large language models have expanded the range of applications they support, from short interactive exchanges to long, compute-heavy requests. LLM serving platforms today define response-latency service-level objectives, even though requests within the same service can differ by orders of magnitude in input length, generation length, execution cost, and the availability of reusable KV-cache state. As a result, requests governed by the same service level objective have different urgency: after accounting for the time required to execute them, some have substantial latency headroom while others have almost none. We define this headroom---the difference between a request's service level objective and its predicted remaining service time---as its per-request latency budget. We present Cascade, an LLM serving system that estimates and continuously updates this budget from request characteristics, KV-cache state, and current system load. Unlike prior SLO-aware schedulers that use deadlines to govern request ordering alone, Cascade uses a single per-request budget to jointly coordinate request scheduling and KV-cache management across the memory hierarchy. Its scheduler prioritizes requests with little remaining budget, while its memory manager uses the same budget to decide whether non-resident KV state should be restored or prefetched from a deeper tier, retained in HBM, or recomputed. By directing queueing and data-movement overhead toward requests that can absorb it, Cascade improves SLO-satisfied goodput while preserving fairness across heterogeneous request classes. On production traces across three large language models, Cascade improves goodput by up to2.4x and reduces SLO violations by 40% relative to the default vLLM first-come, first-served scheduler.
Primary: Microsoft Azure Research
All Institutions: Microsoft Azure Research
Cascade introduces a unified framework for LLM inference serving that leverages per-request latency budgets to jointly optimize scheduling and KV-cache management, demonstrating significant improvements in goodput and SLO adherence on production workloads.
The paper proposes "Cascade," a scheduling and memory management system for LLM inference. The core innovation is the concept of a "per-request latency budget," defined as the difference between the Service Level Objective (SLO) and the predicted remaining service time. This budget is used to jointly coordinate two traditionally separate problems: request scheduling (prioritizing requests with little budget) and KV-cache management (deciding whether to restore, prefetch, or recompute KV-cache entries based on the budget). The approach integrates prediction models for latency with system-level heuristics for memory hierarchy management. The methodology is sound and addresses a critical gap in current LLM serving systems (like vLLM) which often treat scheduling and memory management independently or use static priorities.
The evaluation is conducted on production traces across three large language models, comparing Cascade against the default vLLM first-come, first-served (FCFS) scheduler. The results claim a 2.4x improvement in goodput and a 40% reduction in SLO violations. The use of production traces adds significant credibility to the evaluation, as synthetic workloads often fail to capture the heterogeneity of real-world LLM traffic. The metrics chosen (goodput, SLO violation rate) are standard and appropriate for serving systems. However, the abstract-only nature of the provided text limits the ability to verify the statistical significance or the specific configuration of the "three large language models" and the trace characteristics.
The paper acknowledges the use of AI assistants for implementation and writing, which is transparent. The use of production traces suggests that the experimental setup is tied to specific infrastructure, which might make exact replication difficult without access to the same traces and hardware. However, the methodology is described in sufficient detail in the abstract to understand the core logic. Full reproducibility would depend on the availability of the code and the specific trace datasets, which are not explicitly linked in the provided text.
The primary limitation is the reliance on accurate prediction of remaining service time. If the prediction model is inaccurate, the budget calculation could lead to suboptimal scheduling or memory decisions. The paper does not detail the robustness of the prediction model under distribution shifts or adversarial inputs. Additionally, the "2.4x" improvement is relative to FCFS; comparisons with other advanced schedulers (e.g., those using deadline-aware or priority-based scheduling) are not mentioned in the abstract, which is a significant gap in the related work context. The system's overhead in maintaining the budget and updating predictions must be negligible to justify its use, which is not quantified in the abstract.
This work contributes to the broader field of efficient LLM serving, which is critical for the widespread deployment of large models. By improving goodput and fairness, it helps reduce the cost of LLM inference services and improves user experience. The joint optimization of scheduling and memory management is a promising direction for future systems research. Cascade introduces a unified framework for LLM inference serving that leverages per-request latency budgets to jointly optimize scheduling and KV-cache management, demonstrating significant improvements in goodput and SLO adherence on production workloads.
On-device deployment of Large Language Models (LLMs) has become essential for personalized edge applications. A primary bottleneck is external memory access (EMA) in feed-forward network (FFN) layers. Speculative decoding and mixture-of-experts (MoE) are promising solutions. Speculative decoding reduces the number of decoding stages by generating multiple tokens per stage, and MoE minimizes per-stage cost through sparse expert activation. However, there is an incompatibility when combining these two techniques. We propose EdgeXpert, a software-hardware co-designed LLM accelerator that resolves this incompatibility. In the prefill stage, the prompt-wise expert reuse reformulates routing as prompt-level expert reuse rather than independent per-token expert selection. It identifies important tokens using a lightweight encoder, constructs a shared expert set from them, and routes less important tokens with a reduced expert budget to lower expert EMA. In the decode stage, depth-aware expert coalescing exploits the contextual similarity and mutual exclusivity of same-depth candidate tokens. Rather than loading the union of all required channels, EdgeXpert loads only salient channels and applies computational calibration to recover accuracy without additional memory access. Synthesized in Samsung 28nm technology at 800 MHz, EdgeXpert achieves up to 56.3% latency reduction and 44.1% energy reduction compared to prior works, while maintaining near-baseline accuracy.
Primary: KAIST
All Institutions: KAIST
EdgeXpert presents a compelling software-hardware co-design solution for edge LLM inference, effectively bridging the gap between speculative decoding and mixture-of-experts architectures to achieve substantial latency and energy savings. The rigorous hardware implementation and clear performance gains make it a valuable contribution to the field of efficient AI systems.
The paper proposes EdgeXpert, a software-hardware co-designed accelerator targeting the specific bottleneck of External Memory Access (EMA) in Large Language Model (LLM) inference on edge devices. The core innovation lies in resolving the incompatibility between Speculative Decoding (SD) and Mixture-of-Experts (MoE). The authors introduce two key techniques: 1) Prompt-wise Expert Reuse in the prefill stage, which identifies important tokens and constructs a shared expert set to reduce the expert budget for less important tokens, thereby lowering EMA. 2) Depth-aware Expert Coalescing in the decode stage, which exploits contextual similarity among same-depth candidate tokens to load only salient channels and applies computational calibration to recover accuracy. This approach is technically sound and addresses a critical gap in current edge LLM deployment, where memory bandwidth is the primary constraint. The co-design aspect (algorithmic routing changes + hardware support) is well-motivated.
The evaluation is conducted on a synthesized chip using Samsung 28nm technology at 800 MHz. The results claim up to 56.3% latency reduction and 44.1% energy reduction compared to prior works, while maintaining near-baseline accuracy. The metrics are relevant to the edge deployment context. However, the citation count is 0, and the venue is listed as MICRO 2026 (which is in the future relative to the current date, suggesting this might be a preprint or the venue information is projected/hypothetical in the prompt context, but we treat it as a top-tier systems venue). The performance gains are significant and directly address the stated problem. The use of a custom silicon implementation adds weight to the hardware contributions, although the lack of software ecosystem details or broader model compatibility testing (beyond the implied standard LLMs) is a minor gap.
The paper provides specific technology node (Samsung 28nm) and frequency (800 MHz), which aids in hardware reproducibility. However, as is common with hardware papers, the full RTL or detailed microarchitecture diagrams might be proprietary or omitted for brevity. The algorithmic components (routing, calibration) are described, but the exact hyperparameters for the "lightweight encoder" and "computational calibration" are not fully detailed in the abstract, though presumably present in the full text. Reproducibility is moderate to high for systems researchers but lower for pure ML researchers without hardware access.
The primary limitation is the reliance on a specific hardware implementation (28nm), which may not generalize to newer process nodes or different hardware architectures without significant redesign. The "computational calibration" to recover accuracy suggests that the sparsity introduced by the coalescing technique incurs some accuracy loss, which is mitigated but not eliminated. The effectiveness of the "prompt-wise expert reuse" depends heavily on the quality of the lightweight encoder, which adds its own latency and energy overhead, a trade-off that must be carefully balanced. Furthermore, the evaluation is limited to inference; training or fine-tuning on such hardware is not addressed.
This work has significant implications for democratizing LLMs by enabling high-performance, low-power inference on resource-constrained edge devices. This could accelerate the deployment of personalized AI assistants, privacy-preserving local AI, and IoT applications. By reducing energy consumption and latency, it supports the sustainability goals of AI deployment. The co-design approach provides a blueprint for future hardware-software integration for emerging model architectures. EdgeXpert presents a compelling software-hardware co-design solution for edge LLM inference, effectively bridging the gap between speculative decoding and mixture-of-experts architectures to achieve substantial latency and energy savings. The rigorous hardware implementation and clear performance gains make it a valuable contribution to the field of efficient AI systems.